This is a test post to verify the verification system works.

\",\n content_type: \"html\",\n author_email: \"test@example.com\",\n author_name: \"Test User\",\n verification_token: verificationToken,\n expires_at: expiresAt\n };\n \n const draft = await createDraftPost(draftData);\n await createEmailVerification(\"test@example.com\", verificationToken, draft.id, expiresAt);\n \n // Test retrieval\n const retrievedDraft = await getDraftPostByToken(verificationToken);\n const retrievedVerification = await getEmailVerificationByToken(verificationToken);\n \n const baseUrl = c.req.header(\"host\") ? `https://${c.req.header(\"host\")}` : \"http://localhost\";\n const verificationUrl = `${baseUrl.replace('test-verification', 'backend/index')}/verify-email?token=${verificationToken}`;\n \n const html = `\n\n\n\n \n \n Verification Test\n \n\n\n

🧪 Verification System Test

\n \n

✅ Test Results

\n Draft Post Created: ${draft ? '✅ Success' : '❌ Failed'}\n ${draft ? `

ID: ${draft.id}, Title: ${draft.title}

` : ''}\n

\n Verification Record Created: ${retrievedVerification ? '✅ Success' : '❌ Failed'}\n ${retrievedVerification ? `

ID: ${retrievedVerification.id}, Email: ${retrievedVerification.email}

` : ''}\n

\n Draft Retrieval: ${retrievedDraft ? '✅ Success' : '❌ Failed'}\n

\n\n \n

🔗 Test Verification Link

Click the link below to test the verification process:

\n \n 🔐 Test Verification Link\n \n

\n ${verificationUrl}\n

\n\n \n

🔍 Debug Information

Token: ${verificationToken.substring(0, 20)}...

Expires: ${expiresAt}

Draft ID: ${draft?.id}

Verification ID: ${retrievedVerification?.id}

\n\n\n `;\n \n return c.html(html);\n } catch (error) {\n return c.text(`Error: ${error.message}\\n\\nStack: ${error.stack}`, 500);\n }\n});\n\nexport default app.fetch;","deleted","label",[138],"a4499cda-69a3-11f0-aa22-0224a6c84d84","test-publish.ts","0198439f-c37b-732a-a384-1a9e8062a603",["D",1753481200444],"/**\n * Test endpoint to simulate email publishing\n * \n * ⚠️ DEVELOPMENT ONLY - This endpoint is only accessible when:\n * - NODE_ENV=development, OR\n * - DEV_MODE=true, OR \n * - ENABLE_TEST_ENDPOINTS=true\n */\n\nimport { createPost, generateUniqueSlug } from \"./backend/database/queries.ts\";\nimport { initializeDatabase } from \"./backend/database/schema.ts\";\nimport { slugify, extractAuthorName, isHTML, textToHTML, devOnly } from \"./shared/utils.ts\";\nimport { CreatePostData } from \"./shared/types.ts\";\n\nexport default async function(req: Request) {\n return devOnly(async () => {\n try {\n // Initialize database\n await initializeDatabase();\n\n // Create a test post with HTML entities to test the fix\n const title = \"Testing HTML Entity Decoding\";\n const content = `

HTML Entity Test

I'm testing HTML entity decoding in social media posts.

Here are some "quotes" and & ampersands that should be properly decoded.

This post contains:

Apostrophes: I've, don't, can't
Quotes: "Hello World"
Ampersands: Tom & Jerry
Copyright: © 2024
Em dash: This — is a test

When posted to Mastodon & Bluesky, these should appear as normal characters!

`;\n \n const authorEmail = \"demo@example.com\";\n const authorName = \"Demo User\";\n \n // Generate slug\n const baseSlug = slugify(title);\n const slug = await generateUniqueSlug(baseSlug);\n \n // Create post data\n const postData: CreatePostData = {\n title,\n slug,\n content,\n content_type: 'html',\n author_email: authorEmail,\n author_name: authorName\n };\n\n // Save post to database\n const post = await createPost(postData);\n \n return new Response(JSON.stringify({\n success: true,\n message: \"Test post created successfully!\",\n post: {\n id: post.id,\n title: post.title,\n slug: post.slug,\n author: post.author_name,\n published_at: post.published_at\n }\n }), {\n headers: { \"Content-Type\": \"application/json\" }\n });\n \n } catch (error) {\n console.error('Error creating test post:', error);\n return new Response(JSON.stringify({\n success: false,\n error: error.message\n }), {\n status: 500,\n headers: { \"Content-Type\": \"application/json\" }\n });\n }\n });\n}",[154],"a449953c-69a3-11f0-aa22-0224a6c84d84","test-http-signatures.ts","0198439f-c37b-732a-a384-157c0b194940",["D",1753481200444],"/**\n * Test HTTP Signatures Implementation\n * \n * This script tests the HTTP signatures functionality to ensure\n * ActivityPub federation is working correctly.\n * \n * ⚠️ DEVELOPMENT ONLY - This endpoint is only accessible when:\n * - NODE_ENV=development, OR\n * - DEV_MODE=true, OR \n * - ENABLE_TEST_ENDPOINTS=true\n */\n\nimport { createActivityPubHeaders, isHttpSignaturesEnabled, getPublicKeyPem } from \"./backend/services/http-signatures.ts\";\nimport { devOnly } from \"./shared/utils.ts\";\n\nexport default async function testHttpSignatures() {\n return devOnly(async () => {\n try {\n console.log('🧪 Testing HTTP Signatures Implementation...');\n \n // Test 1: Check if HTTP signatures are enabled\n console.log('\\n1️⃣ Testing HTTP signatures status...');\n const isEnabled = isHttpSignaturesEnabled();\n console.log(`HTTP Signatures Enabled: ${isEnabled ? '✅ YES' : '❌ NO'}`);\n \n // Test 2: Get public key\n console.log('\\n2️⃣ Testing public key retrieval...');\n try {\n const publicKeyPem = await getPublicKeyPem();\n const hasValidKey = publicKeyPem.includes('-----BEGIN PUBLIC KEY-----') && \n publicKeyPem.includes('-----END PUBLIC KEY-----');\n console.log(`Public Key Valid: ${hasValidKey ? '✅ YES' : '❌ NO'}`);\n console.log(`Public Key Length: ${publicKeyPem.length} characters`);\n \n // Show first and last few characters for verification\n const keyContent = publicKeyPem.replace(/-----BEGIN PUBLIC KEY-----|\\\\n|-----END PUBLIC KEY-----/g, '');\n console.log(`Key Preview: ${keyContent.substring(0, 20)}...${keyContent.substring(keyContent.length - 20)}`);\n } catch (error) {\n console.error('❌ Failed to get public key:', error.message);\n }\n \n // Test 3: Create HTTP signature headers\n console.log('\\n3️⃣ Testing HTTP signature creation...');\n try {\n const testUrl = 'https://example.com/inbox';\n const testActorBaseUrl = 'https://posthero.us'; // Use your actual domain\n const testBody = JSON.stringify({\n '@context': 'https://www.w3.org/ns/activitystreams',\n type: 'Create',\n actor: `${testActorBaseUrl}/actor`,\n object: {\n type: 'Note',\n content: 'Test post'\n }\n });\n \n const headers = await createActivityPubHeaders('POST', testUrl, testBody, testActorBaseUrl);\n \n console.log('Generated Headers:');\n console.log(`- Content-Type: ${headers['Content-Type']}`);\n console.log(`- Date: ${headers['Date']}`);\n console.log(`- Digest: ${headers['Digest'] ? '✅ Present' : '❌ Missing'}`);\n console.log(`- Signature: ${headers['Signature'] ? '✅ Present' : '❌ Missing'}`);\n \n if (headers['Signature']) {\n // Parse signature header\n const sigParts = headers['Signature'].split(',').reduce((acc, part) => {\n const [key, value] = part.split('=');\n acc[key] = value.replace(/\"/g, '');\n return acc;\n }, {} as Record);\n \n console.log('Signature Details:');\n console.log(`- Key ID: ${sigParts.keyId}`);\n console.log(`- Algorithm: ${sigParts.algorithm}`);\n console.log(`- Headers: ${sigParts.headers}`);\n console.log(`- Signature Length: ${sigParts.signature?.length || 0} characters`);\n }\n \n } catch (error) {\n console.error('❌ Failed to create HTTP signature:', error.message);\n }\n \n // Test 4: Environment variables check\n console.log('\\n4️⃣ Testing environment variables...');\n const hasPublicKey = !!Deno.env.get('ACTIVITYPUB_PUBLIC_KEY');\n const hasPrivateKey = !!Deno.env.get('ACTIVITYPUB_PRIVATE_KEY');\n \n console.log(`ACTIVITYPUB_PUBLIC_KEY: ${hasPublicKey ? '✅ Set' : '❌ Not Set'}`);\n console.log(`ACTIVITYPUB_PRIVATE_KEY: ${hasPrivateKey ? '✅ Set' : '❌ Not Set'}`);\n \n if (hasPublicKey && hasPrivateKey) {\n console.log('✅ Persistent keys are configured - federation will work reliably');\n } else {\n console.log('⚠️ Using temporary keys - consider setting persistent keys for production');\n }\n \n // Summary\n console.log('\\n📊 SUMMARY:');\n const allGood = isEnabled && hasPublicKey && hasPrivateKey;\n console.log(`Overall Status: ${allGood ? '✅ READY FOR PRODUCTION' : '⚠️ NEEDS ATTENTION'}`);\n \n if (!allGood) {\n console.log('\\n🔧 RECOMMENDATIONS:');\n if (!hasPublicKey || !hasPrivateKey) {\n console.log('- Visit /generate-keys.ts to generate persistent RSA keys');\n console.log('- Set ACTIVITYPUB_PUBLIC_KEY and ACTIVITYPUB_PRIVATE_KEY environment variables');\n }\n }\n\n return new Response(`\n\n\n\n HTTP Signatures Test Results\n \n\n\n

🧪 HTTP Signatures Test Results

\n \n

\n Overall Status: ${allGood ? '✅ READY FOR PRODUCTION' : '⚠️ NEEDS ATTENTION'}\n

\n\n

1️⃣ HTTP Signatures Status

\n HTTP Signatures Enabled: ${isEnabled ? '✅ YES' : '❌ NO'}\n

\n\n

2️⃣ Public Key Status

Public Key: ✅ Valid

Key Length: ${(await getPublicKeyPem()).length} characters

\n\n

3️⃣ Environment Variables

\n ACTIVITYPUB_PUBLIC_KEY: ${hasPublicKey ? '✅ Set' : '❌ Not Set'}\n

\n ACTIVITYPUB_PRIVATE_KEY: ${hasPrivateKey ? '✅ Set' : '❌ Not Set'}\n

\n\n

4️⃣ Federation Status

\n ${hasPublicKey && hasPrivateKey ? \n '

✅ Persistent keys configured - federation will work reliably

' :\n '

⚠️ Using temporary keys - consider setting persistent keys for production

'\n }\n

\n\n ${!allGood ? `\n

🔧 Recommendations

Visit /generate-keys.ts to generate persistent RSA keys
Set ACTIVITYPUB_PUBLIC_KEY and ACTIVITYPUB_PRIVATE_KEY environment variables

\n ` : ''}\n\n

📚 Next Steps

Test federation by following your blog from Mastodon
Check ActivityPub actor at /actor
Monitor logs for delivery success/failures
Publish a test post to verify push delivery

\n\n\n `, {\n headers: {\n 'Content-Type': 'text/html',\n },\n });\n\n } catch (error) {\n console.error('❌ Test failed:', error);\n return new Response(`\n\n\n\n HTTP Signatures Test Error\n \n\n\n

❌ HTTP Signatures Test Failed

\n Error: ${error.message}\n

Check the console logs for more details.

\n\n\n `, {\n headers: {\n 'Content-Type': 'text/html',\n },\n status: 500,\n });\n }\n });\n}",[160],"a4498f92-69a3-11f0-aa22-0224a6c84d84","test-follow.ts","0198439f-c37b-732a-a384-126a955abcd9",["D",1753481200444],"/**\n * Test Follow Activity Processing\n * \n * This script tests the Follow activity processing and Accept response\n * \n * ⚠️ DEVELOPMENT ONLY - This endpoint is only accessible when:\n * - NODE_ENV=development, OR\n * - DEV_MODE=true, OR \n * - ENABLE_TEST_ENDPOINTS=true\n */\n\nimport { processInboxActivity } from \"./backend/services/activitypub-inbox.ts\";\nimport { devOnly } from \"./shared/utils.ts\";\n\nexport default async function testFollow() {\n return devOnly(async () => {\n try {\n console.log('🧪 Testing Follow Activity Processing...');\n \n // Create a test Follow activity\n const testFollowActivity = {\n \"@context\": \"https://www.w3.org/ns/activitystreams\",\n \"id\": \"https://test.example/activities/follow-123\",\n \"type\": \"Follow\",\n \"actor\": \"https://test.example/users/testuser\",\n \"object\": \"https://posthero.us/actor\",\n \"published\": new Date().toISOString()\n };\n \n console.log('📝 Test Follow activity created:', {\n id: testFollowActivity.id,\n type: testFollowActivity.type,\n actor: testFollowActivity.actor,\n object: testFollowActivity.object\n });\n \n // Process the Follow activity\n console.log('🚀 Processing Follow activity...');\n const result = await processInboxActivity(testFollowActivity, \"posthero.us\");\n \n console.log('✅ Follow activity processing result:', result);\n \n return new Response(`\n\n\n\n Follow Activity Test Results\n \n\n\n

🧪 Follow Activity Test Results

\n \n ${result.success ? `\n

\n ✅ Test Completed Successfully!\n

The Follow activity was processed successfully.

Result: ${result.message}

\n ` : `\n

\n ❌ Test Failed!\n

The Follow activity processing failed.

Error: ${result.message}

\n `}\n\n

📝 Test Activity Details

Activity ID: ${testFollowActivity.id}

Activity Type: ${testFollowActivity.type}

Actor: ${testFollowActivity.actor}

Object: ${testFollowActivity.object}

\n\n

🔍 What to Check

Console Logs: Look for Accept activity delivery messages
Database: Check if the follower was added to the database
HTTP Signatures: Verify Accept activity was signed and sent
Target Inbox: Check if the Accept reached the follower's inbox

\n\n

🎯 Expected Results

If the Follow processing is working correctly, you should see:

✅ Follow activity processed successfully
✅ Actor information fetched from test.example
✅ Follower added to database
✅ Accept activity created and sent with HTTP signatures

\n\n\n `, {\n headers: {\n 'Content-Type': 'text/html',\n },\n });\n\n } catch (error) {\n console.error('❌ Follow activity test failed:', error);\n \n return new Response(`\n\n\n\n Follow Activity Test Error\n \n\n\n

❌ Follow Activity Test Failed

\n Error: ${error.message}\n

Check the console logs for more details about the failure.

\n\n\n `, {\n headers: {\n 'Content-Type': 'text/html',\n },\n status: 500,\n });\n }\n });\n}",[166],"a4498c0e-69a3-11f0-aa22-0224a6c84d84","test-entity-fix.ts","0198439f-c37b-732a-a384-0e6445e2a525",["D",1753481200444],"script","import { createATProtoPostContent, truncateHTML, decodeHTMLEntities } from \"./shared/utils.ts\";\n\nexport default async function(req: Request): Promise {\n // Test with the actual content from your blog post\n const testTitle = \"Hypertext - we've missed a lot.\";\n const testContent = `

I'm writing this on my phone as I dab on Aloe Vera to appease the sunburn.

I've spent some time reading about the nature of hyperlinking and how people thought about it from the Memex and through to Xanadu.

It's very fun to read the ideas that people had about ep, 40, 50 and 60 years ago. I'm eager to do a comparison of now and then. For example, I see mentions of creating Trails (now know as Browser History in web parlance), direct connections (anchors in HTML) and Indexing (now search).

`;\n const testUrl = \"https://example.com/post/hypertext-weve-missed-a-lot\";\n\n // Test the functions\n const truncatedBefore = testContent.replace(/<[^>]*>/g, ' ').replace(/\\s+/g, ' ').trim();\n const truncatedAfter = truncateHTML(testContent, 200);\n const atProtoContent = createATProtoPostContent(testTitle, testContent, testUrl, 300);\n const decodedEntities = decodeHTMLEntities(\"I'm testing "quotes" and & symbols\");\n\n return new Response(`\n

HTML Entity Fix Test Results

\n \n

Original Content (with entities):

${testContent}

\n \n

Before Fix (truncated with entities):

${truncatedBefore.substring(0, 200)}...

\n \n

After Fix (truncated with decoded entities):

${truncatedAfter}

\n \n

AT Protocol Post Content:

${atProtoContent}

\n \n

Entity Decoding Test:

Before: I'm testing "quotes" and & symbols

After: ${decodedEntities}

\n \n

Test Results:

Contains ' in original: ${testContent.includes(''') ? '✅' : '❌'}
No ' in truncated: ${!truncatedAfter.includes(''') ? '✅' : '❌'}
Contains apostrophe in truncated: ${truncatedAfter.includes(\"'\") ? '✅' : '❌'}
No ' in AT Proto content: ${!atProtoContent.includes(''') ? '✅' : '❌'}
Contains apostrophe in AT Proto: ${atProtoContent.includes(\"'\") ? '✅' : '❌'}

\n `, {\n headers: { 'Content-Type': 'text/html' }\n });\n}",[172],"a449881c-69a3-11f0-aa22-0224a6c84d84","test-activitypub.ts","0198439f-c37b-732a-a384-09a1ce9a394b",["D",1753481200444],"/**\n * Test script to verify ActivityPub and WebFinger implementation\n * \n * This script tests all the ActivityPub endpoints to ensure they're working correctly.\n * \n * ⚠️ DEVELOPMENT ONLY - This endpoint is only accessible when:\n * - NODE_ENV=development, OR\n * - DEV_MODE=true, OR \n * - ENABLE_TEST_ENDPOINTS=true\n */\n\nimport { devOnly } from \"./shared/utils.ts\";\n\nconst BASE_URL = 'https://your-val-name.web.val.run'; // Replace with your actual domain\n\nasync function testActivityPubEndpoints() {\n console.log('🧪 Testing ActivityPub and WebFinger endpoints...\\n');\n \n const tests = [\n {\n name: 'WebFinger - acct format',\n url: `${BASE_URL}/.well-known/webfinger?resource=acct:blog@your-domain.com`,\n expectedContentType: 'application/jrd+json'\n },\n {\n name: 'WebFinger - direct URL format',\n url: `${BASE_URL}/.well-known/webfinger?resource=${BASE_URL}/actor`,\n expectedContentType: 'application/jrd+json'\n },\n {\n name: 'ActivityPub Actor',\n url: `${BASE_URL}/actor`,\n expectedContentType: 'application/activity+json'\n },\n {\n name: 'ActivityPub Outbox',\n url: `${BASE_URL}/outbox`,\n expectedContentType: 'application/activity+json'\n },\n {\n name: 'ActivityPub Followers',\n url: `${BASE_URL}/followers`,\n expectedContentType: 'application/activity+json'\n },\n {\n name: 'ActivityPub Following',\n url: `${BASE_URL}/following`,\n expectedContentType: 'application/activity+json'\n }\n ];\n \n for (const test of tests) {\n try {\n console.log(`Testing: ${test.name}`);\n const response = await fetch(test.url);\n \n if (response.ok) {\n const contentType = response.headers.get('content-type');\n const data = await response.json();\n \n console.log(`✅ ${test.name}: OK (${response.status})`);\n console.log(` Content-Type: ${contentType}`);\n \n if (test.name.includes('WebFinger')) {\n console.log(` Subject: ${data.subject}`);\n console.log(` Links: ${data.links?.length || 0} found`);\n } else if (test.name.includes('Actor')) {\n console.log(` Type: ${data.type}`);\n console.log(` Username: ${data.preferredUsername}`);\n console.log(` Name: ${data.name}`);\n } else if (test.name.includes('Outbox')) {\n console.log(` Type: ${data.type}`);\n console.log(` Total Items: ${data.totalItems}`);\n } else if (test.name.includes('Followers') || test.name.includes('Following')) {\n console.log(` Type: ${data.type}`);\n console.log(` Total Items: ${data.totalItems}`);\n }\n \n console.log('');\n } else {\n console.log(`❌ ${test.name}: Failed (${response.status})`);\n const errorText = await response.text();\n console.log(` Error: ${errorText}`);\n console.log('');\n }\n } catch (error) {\n console.log(`❌ ${test.name}: Error`);\n console.log(` ${error.message}`);\n console.log('');\n }\n }\n \n console.log('🎉 ActivityPub testing complete!');\n console.log('\\n📝 Next steps:');\n console.log('1. Replace BASE_URL with your actual domain');\n console.log('2. Test WebFinger with your actual domain in the resource parameter');\n console.log('3. Try following your blog from a Mastodon instance using @blog@your-domain.com');\n}\n\nexport default async function() {\n return devOnly(async () => {\n await testActivityPubEndpoints();\n return new Response('ActivityPub test completed. Check console for results.', {\n headers: { 'Content-Type': 'text/plain' }\n });\n });\n}",[179],"a4498394-69a3-11f0-aa22-0224a6c84d84","test-activitypub-inbox.ts","0198439f-c37b-732a-a384-066666df3ef6",["D",1753481200444],"/**\n * Test script for ActivityPub inbox functionality\n * \n * This script simulates various ActivityPub activities to test the inbox processing.\n * \n * ⚠️ DEVELOPMENT ONLY - This endpoint is only accessible when:\n * - NODE_ENV=development, OR\n * - DEV_MODE=true, OR \n * - ENABLE_TEST_ENDPOINTS=true\n */\n\nimport { devOnly } from \"./shared/utils.ts\";\n\nconst BASE_URL = 'https://paulkinlan--260c95825dca11f0b2ad0224a6c84d84.web.val.run'; // Replace with your actual domain\n\nasync function testActivityPubInbox() {\n console.log('🧪 Testing ActivityPub inbox functionality...\\n');\n \n // Test Follow activity\n const followActivity = {\n '@context': 'https://www.w3.org/ns/activitystreams',\n id: 'https://mastodon.social/users/testuser#follows/123',\n type: 'Follow',\n actor: {\n id: 'https://mastodon.social/users/testuser',\n type: 'Person',\n preferredUsername: 'testuser',\n name: 'Test User',\n inbox: 'https://mastodon.social/users/testuser/inbox',\n icon: {\n type: 'Image',\n url: 'https://mastodon.social/avatars/testuser.jpg'\n },\n endpoints: {\n sharedInbox: 'https://mastodon.social/inbox'\n }\n },\n object: `${BASE_URL}/actor`,\n published: new Date().toISOString()\n };\n\n console.log('📤 Testing Follow activity...');\n try {\n const response = await fetch(`${BASE_URL}/inbox`, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/activity+json'\n },\n body: JSON.stringify(followActivity)\n });\n\n if (response.ok) {\n console.log('✅ Follow activity processed successfully');\n \n // Check if follower was added\n const followersResponse = await fetch(`${BASE_URL}/followers`);\n const followersData = await followersResponse.json();\n console.log(` Followers count: ${followersData.totalItems}`);\n \n if (followersData.totalItems > 0) {\n console.log(` New follower: ${followersData.orderedItems[0]}`);\n }\n } else {\n console.log(`❌ Follow activity failed: ${response.status}`);\n const errorText = await response.text();\n console.log(` Error: ${errorText}`);\n }\n } catch (error) {\n console.log(`❌ Follow activity error: ${error.message}`);\n }\n\n console.log('');\n\n // Test Like activity\n const likeActivity = {\n '@context': 'https://www.w3.org/ns/activitystreams',\n id: 'https://mastodon.social/users/testuser#likes/456',\n type: 'Like',\n actor: 'https://mastodon.social/users/testuser',\n object: `${BASE_URL}/post/test`, // Assuming there's a post with slug 'test'\n published: new Date().toISOString()\n };\n\n console.log('❤️ Testing Like activity...');\n try {\n const response = await fetch(`${BASE_URL}/inbox`, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/activity+json'\n },\n body: JSON.stringify(likeActivity)\n });\n\n if (response.ok) {\n console.log('✅ Like activity processed successfully');\n \n // Check activity counts for the post\n const activityResponse = await fetch(`${BASE_URL}/api/posts/test/activities`);\n if (activityResponse.ok) {\n const activityData = await activityResponse.json();\n console.log(` Likes: ${activityData.activityCounts.likes}`);\n console.log(` Shares: ${activityData.activityCounts.shares}`);\n console.log(` Replies: ${activityData.activityCounts.replies}`);\n }\n } else {\n console.log(`❌ Like activity failed: ${response.status}`);\n const errorText = await response.text();\n console.log(` Error: ${errorText}`);\n }\n } catch (error) {\n console.log(`❌ Like activity error: ${error.message}`);\n }\n\n console.log('');\n\n // Test Announce (share) activity\n const announceActivity = {\n '@context': 'https://www.w3.org/ns/activitystreams',\n id: 'https://mastodon.social/users/testuser#announces/789',\n type: 'Announce',\n actor: 'https://mastodon.social/users/testuser',\n object: `${BASE_URL}/post/test`,\n published: new Date().toISOString(),\n to: ['https://www.w3.org/ns/activitystreams#Public']\n };\n\n console.log('🔄 Testing Announce (share) activity...');\n try {\n const response = await fetch(`${BASE_URL}/inbox`, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/activity+json'\n },\n body: JSON.stringify(announceActivity)\n });\n\n if (response.ok) {\n console.log('✅ Announce activity processed successfully');\n \n // Check activity counts for the post\n const activityResponse = await fetch(`${BASE_URL}/api/posts/test/activities`);\n if (activityResponse.ok) {\n const activityData = await activityResponse.json();\n console.log(` Likes: ${activityData.activityCounts.likes}`);\n console.log(` Shares: ${activityData.activityCounts.shares}`);\n console.log(` Replies: ${activityData.activityCounts.replies}`);\n }\n } else {\n console.log(`❌ Announce activity failed: ${response.status}`);\n const errorText = await response.text();\n console.log(` Error: ${errorText}`);\n }\n } catch (error) {\n console.log(`❌ Announce activity error: ${error.message}`);\n }\n\n console.log('');\n\n // Test Undo Follow activity\n const undoFollowActivity = {\n '@context': 'https://www.w3.org/ns/activitystreams',\n id: 'https://mastodon.social/users/testuser#undo/123',\n type: 'Undo',\n actor: 'https://mastodon.social/users/testuser',\n object: {\n id: 'https://mastodon.social/users/testuser#follows/123',\n type: 'Follow',\n actor: 'https://mastodon.social/users/testuser',\n object: `${BASE_URL}/actor`\n },\n published: new Date().toISOString()\n };\n\n console.log('↩️ Testing Undo Follow activity...');\n try {\n const response = await fetch(`${BASE_URL}/inbox`, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/activity+json'\n },\n body: JSON.stringify(undoFollowActivity)\n });\n\n if (response.ok) {\n console.log('✅ Undo Follow activity processed successfully');\n \n // Check if follower was removed\n const followersResponse = await fetch(`${BASE_URL}/followers`);\n const followersData = await followersResponse.json();\n console.log(` Followers count: ${followersData.totalItems}`);\n } else {\n console.log(`❌ Undo Follow activity failed: ${response.status}`);\n const errorText = await response.text();\n console.log(` Error: ${errorText}`);\n }\n } catch (error) {\n console.log(`❌ Undo Follow activity error: ${error.message}`);\n }\n\n console.log('\\n🎉 ActivityPub inbox testing complete!');\n console.log('\\n📊 Final Status:');\n \n // Get final followers count\n try {\n const followersResponse = await fetch(`${BASE_URL}/followers`);\n const followersData = await followersResponse.json();\n console.log(` Total followers: ${followersData.totalItems}`);\n } catch (error) {\n console.log(` Could not fetch followers: ${error.message}`);\n }\n\n // Get final activity counts for test post\n try {\n const activityResponse = await fetch(`${BASE_URL}/api/posts/test/activities`);\n if (activityResponse.ok) {\n const activityData = await activityResponse.json();\n console.log(` Test post activities - Likes: ${activityData.activityCounts.likes}, Shares: ${activityData.activityCounts.shares}, Replies: ${activityData.activityCounts.replies}`);\n }\n } catch (error) {\n console.log(` Could not fetch activity counts: ${error.message}`);\n }\n}\n\nexport default async function() {\n return devOnly(async () => {\n await testActivityPubInbox();\n return new Response('ActivityPub inbox test completed. Check console for results.', {\n headers: { 'Content-Type': 'text/plain' }\n });\n });\n}",[185],"a4497ed0-69a3-11f0-aa22-0224a6c84d84","test-activitypub-delivery.ts","0198439f-c37b-732a-a384-02a0ad952ca6",["D",1753481200444],"/**\n * Test ActivityPub Delivery\n * \n * This script manually tests ActivityPub delivery to verify that HTTP signatures\n * are working correctly with the recent fixes.\n * \n * ⚠️ DEVELOPMENT ONLY - This endpoint is only accessible when:\n * - NODE_ENV=development, OR\n * - DEV_MODE=true, OR \n * - ENABLE_TEST_ENDPOINTS=true\n */\n\nimport { publishToActivityPub } from \"./backend/services/activitypub.ts\";\nimport { BlogPost } from \"./shared/types.ts\";\nimport { devOnly } from \"./shared/utils.ts\";\n\nexport default async function testActivityPubDelivery() {\n return devOnly(async () => {\n try {\n console.log('🧪 Testing ActivityPub Delivery with HTTP Signatures...');\n \n // Create a test blog post\n const testPost: BlogPost = {\n id: 999,\n title: \"HTTP Signatures Test Post\",\n slug: \"http-signatures-test-post\",\n content: \"

Testing HTTP Signatures

This is a test post to verify that HTTP signatures are working correctly with Mastodon. If you see this post in your timeline, the fix was successful!

🎉 The digest header case sensitivity issue has been resolved.

\",\n content_type: \"html\",\n author_email: \"test@example.com\",\n author_name: \"Test Bot\",\n published_at: new Date().toISOString(),\n created_at: new Date().toISOString(),\n updated_at: new Date().toISOString()\n };\n \n console.log('📝 Test post created:', {\n title: testPost.title,\n slug: testPost.slug,\n contentLength: testPost.content.length\n });\n \n // Attempt to publish to ActivityPub\n console.log('🚀 Starting ActivityPub delivery...');\n await publishToActivityPub(testPost);\n \n console.log('✅ ActivityPub delivery completed successfully!');\n \n return new Response(`\n\n\n\n ActivityPub Delivery Test Results\n \n\n\n

🧪 ActivityPub Delivery Test Results

\n \n

\n ✅ Test Completed Successfully!\n

The ActivityPub delivery test has been executed. Check the console logs for detailed results.

\n\n

📝 Test Post Details

Title: ${testPost.title}

Slug: ${testPost.slug}

Content Length: ${testPost.content.length} characters

Published: ${testPost.published_at}

\n\n

🔍 What to Check

Console Logs: Look for delivery success/failure messages
Mastodon Timeline: Check if the test post appears in followers' timelines
HTTP Status: Look for 200/202 responses instead of 401 errors
Signature Verification: Ensure no \"verification failed\" errors

\n\n

🎯 Expected Results

If the HTTP signatures fix worked correctly, you should see:

✅ Successful delivery to https://status.kinlan.me/inbox
✅ No 401 \"Public key not found\" errors
✅ No \"Verification failed\" errors
✅ Test post appearing in Paul's Mastodon timeline

\n\n

🔧 Recent Fixes Applied

Digest Header Case Sensitivity: Fixed to handle both \"digest\" and \"Digest\" headers
Signing String Construction: Now correctly includes digest in signing string
Public Key Format: Ensured proper PEM formatting with newlines
KeyId Correction: Fixed to use your domain instead of target domain

\n\n\n `, {\n headers: {\n 'Content-Type': 'text/html',\n },\n });\n\n } catch (error) {\n console.error('❌ ActivityPub delivery test failed:', error);\n \n return new Response(`\n\n\n\n ActivityPub Delivery Test Error\n \n\n\n

❌ ActivityPub Delivery Test Failed

\n Error: ${error.message}\n

Check the console logs for more details about the failure.

This might indicate that the HTTP signatures still need adjustment.

\n\n\n `, {\n headers: {\n 'Content-Type': 'text/html',\n },\n status: 500,\n });\n }\n });\n}",[191],"a44977be-69a3-11f0-aa22-0224a6c84d84","generate-keys.ts","0198439f-c37b-732a-a383-feea8e8f7124",["D",1753481200444],"/**\n * RSA Key Pair Generator for ActivityPub HTTP Signatures\n * \n * This script generates an RSA key pair for use with ActivityPub HTTP signatures.\n * Run this script to generate the keys, then set them as environment variables.\n * \n * ⚠️ DEVELOPMENT ONLY - This endpoint is only accessible when:\n * - NODE_ENV=development, OR\n * - DEV_MODE=true, OR \n * - ENABLE_TEST_ENDPOINTS=true\n * \n * Usage:\n * 1. Run this script to generate keys\n * 2. Copy the output keys to your environment variables:\n * - ACTIVITYPUB_PUBLIC_KEY\n * - ACTIVITYPUB_PRIVATE_KEY\n */\n\nimport { devOnly } from \"./shared/utils.ts\";\n\nexport default async function generateKeys() {\n return devOnly(async () => {\n try {\n console.log('🔐 Generating RSA key pair for ActivityPub HTTP signatures...');\n \n // Generate RSA key pair using Web Crypto API\n const keyPair = await crypto.subtle.generateKey(\n {\n name: \"RSASSA-PKCS1-v1_5\",\n modulusLength: 2048,\n publicExponent: new Uint8Array([1, 0, 1]),\n hash: \"SHA-256\",\n },\n true,\n [\"sign\", \"verify\"]\n );\n \n // Export keys to PEM format\n const publicKeyBuffer = await crypto.subtle.exportKey(\"spki\", keyPair.publicKey);\n const privateKeyBuffer = await crypto.subtle.exportKey(\"pkcs8\", keyPair.privateKey);\n \n // Convert to PEM format\n const publicKeyPem = `-----BEGIN PUBLIC KEY-----\\n${btoa(String.fromCharCode(...new Uint8Array(publicKeyBuffer))).match(/.{1,64}/g)?.join('\\n')}\\n-----END PUBLIC KEY-----`;\n const privateKeyPem = `-----BEGIN PRIVATE KEY-----\\n${btoa(String.fromCharCode(...new Uint8Array(privateKeyBuffer))).match(/.{1,64}/g)?.join('\\n')}\\n-----END PRIVATE KEY-----`;\n \n console.log('✅ RSA key pair generated successfully!');\n console.log('📋 Copy these keys to your environment variables:');\n console.log('\\nACTIVITYPUB_PUBLIC_KEY:');\n console.log(publicKeyPem);\n console.log('\\nACTIVITYPUB_PRIVATE_KEY:');\n console.log(privateKeyPem);\n \n return new Response(`\n\n\n\n RSA Key Pair Generator\n \n\n\n

🔐 RSA Key Pair Generator

\n \n

\n ✅ Keys Generated Successfully!\n

Your RSA key pair has been generated. Copy the keys below to your environment variables.

\n\n

📋 Environment Variables

Copy these to your Val Town environment variables:

\n \n

ACTIVITYPUB_PUBLIC_KEY:

${publicKeyPem}

\n \n \n

ACTIVITYPUB_PRIVATE_KEY:

${privateKeyPem}

\n \n

\n\n

🔒 IMPORTANT SECURITY NOTES:

Keep the private key secret and secure
Do not share the private key in public repositories
These keys will be used to sign ActivityPub requests
Once set, do not change these keys unless necessary
Changing keys will break federation with existing followers

\n\n

📝 How to set environment variables in Val Town:

Go to your Val Town dashboard
Click on your val
Click \"Settings\" or the gear icon
Add the environment variables above
Save and restart your val

\n\n

\n 🎉 After setting these keys, your ActivityPub federation will be fully functional!\n

\n\n \n\n\n `, {\n headers: {\n 'Content-Type': 'text/html',\n },\n });\n\n } catch (error) {\n console.error('❌ Failed to generate RSA key pair:', error);\n return new Response(`\n\n\n\n Key Generation Error\n \n\n\n

❌ Key Generation Failed

\n Error: ${error.message}\n

Please try again or check the console for more details.

\n\n\n `, {\n headers: {\n 'Content-Type': 'text/html',\n },\n status: 500,\n });\n }\n });\n}",[197],"a4497020-69a3-11f0-aa22-0224a6c84d84","email.ts","0198439f-c37b-732a-a383-fb68608e82be",["D",1753481200444],"email","import { createDraftPost, generateUniqueSlug, createEmailVerification, cleanupExpiredDrafts } from \"./backend/database/queries.ts\";\nimport { initializeDatabase } from \"./backend/database/schema.ts\";\nimport { slugify, extractAuthorName, isHTML, textToHTML } from \"./shared/utils.ts\";\nimport { CreateDraftPostData, EmailAttachment } from \"./shared/types.ts\";\nimport { isEmailAllowed, generateVerificationToken, sendVerificationEmail, getVerificationExpiration } from \"./backend/services/email-security.ts\";\nimport { processEmailAttachments, replaceImageReferencesInContent } from \"./backend/services/images.ts\";\n\n// Helper function to extract email address from display name format\nfunction extractEmailAddress(emailString: string): string {\n // Handle formats like \"Display Name \" or just \"email@domain.com\"\n const match = emailString.match(/<([^>]+)>/);\n if (match) {\n return match[1].trim();\n }\n return emailString.trim();\n}\n\n// Helper function to extract display name from email string\nfunction extractDisplayName(emailString: string): string | null {\n // Handle formats like \"Display Name \"\n const match = emailString.match(/^([^<]+)<[^>]+>$/);\n if (match) {\n return match[1].trim();\n }\n return null;\n}\n\ninterface Email {\n from: string;\n to: string[];\n subject: string;\n text?: string;\n html?: string;\n headers: Record;\n attachments?: Array<{\n filename: string;\n contentType: string;\n content: string; // base64 encoded\n size: number;\n }>;\n}\n\nexport default async function(email: Email) {\n const startTime = Date.now();\n console.log('=== EMAIL PROCESSING START ===');\n \n try {\n // Log full email details\n console.log('📧 Email received:', {\n from: email.from,\n to: email.to,\n subject: email.subject,\n hasHtml: !!email.html,\n hasText: !!email.text,\n htmlLength: email.html?.length || 0,\n textLength: email.text?.length || 0,\n headers: Object.keys(email.headers || {}),\n timestamp: new Date().toISOString()\n });\n\n // Log environment configuration\n const allowedEmails = Deno.env.get('ALLOWED_EMAIL_ADDRESSES');\n console.log('🔧 Environment check:', {\n hasAllowedEmails: !!allowedEmails,\n allowedEmailsLength: allowedEmails?.length || 0,\n baseUrl: Deno.env.get('BASE_URL') || 'auto-detect'\n });\n\n console.log('🗄️ Initializing database...');\n await initializeDatabase();\n console.log('✅ Database initialized');\n\n console.log('🧹 Cleaning up expired drafts...');\n await cleanupExpiredDrafts();\n console.log('✅ Cleanup completed');\n\n // Check if sender email is allowed\n const senderEmail = email.from;\n console.log('🔒 Checking email allowlist:', {\n senderEmail: senderEmail,\n normalizedSender: senderEmail.trim().toLowerCase()\n });\n\n if (!isEmailAllowed(senderEmail)) {\n console.error('❌ SECURITY: Email not allowed!', {\n senderEmail: senderEmail,\n allowedEmails: allowedEmails,\n reason: 'Email address not in ALLOWED_EMAIL_ADDRESSES environment variable'\n });\n return;\n }\n console.log('✅ Email address is allowed');\n\n // Extract post data from email\n const title = email.subject.trim();\n console.log('📝 Processing email content:', {\n originalSubject: email.subject,\n trimmedTitle: title,\n titleLength: title.length\n });\n\n if (!title) {\n console.error('❌ Email subject is empty, cannot create post');\n return;\n }\n\n // Prefer HTML content over plain text\n let content = email.html || email.text || '';\n console.log('📄 Content analysis:', {\n hasHtml: !!email.html,\n hasText: !!email.text,\n htmlPreview: email.html ? email.html.substring(0, 100) + '...' : null,\n textPreview: email.text ? email.text.substring(0, 100) + '...' : null,\n finalContentLength: content.length\n });\n\n if (!content.trim()) {\n console.error('❌ Email body is empty, cannot create post');\n return;\n }\n\n // Determine content type and process content\n let contentType: 'html' | 'text';\n if (email.html && isHTML(email.html)) {\n contentType = 'html';\n content = email.html;\n console.log('📋 Content type: HTML (using email.html)');\n } else if (email.text) {\n contentType = 'html'; // Convert text to HTML for consistent rendering\n content = textToHTML(email.text);\n console.log('📋 Content type: Text converted to HTML (using email.text)');\n } else {\n contentType = 'html';\n content = textToHTML(content);\n console.log('📋 Content type: Fallback text converted to HTML');\n }\n\n // Generate slug\n console.log('🔗 Generating slug...');\n const baseSlug = slugify(title);\n const slug = await generateUniqueSlug(baseSlug);\n console.log('✅ Slug generated:', {\n baseSlug: baseSlug,\n finalSlug: slug\n });\n\n // Extract author info - use the actual email address, not the display name\n const authorEmail = extractEmailAddress(email.from);\n const displayName = extractDisplayName(email.from);\n const authorName = displayName || extractAuthorName(authorEmail);\n console.log('👤 Author info:', {\n originalFrom: email.from,\n authorEmail: authorEmail,\n displayName: displayName,\n authorName: authorName\n });\n\n // Process email attachments for images\n let processedImages: any[] = [];\n if (email.attachments && email.attachments.length > 0) {\n console.log('📎 Processing email attachments:', {\n attachmentCount: email.attachments.length,\n attachments: email.attachments.map(att => ({\n filename: att.filename,\n contentType: att.contentType,\n size: att.size\n }))\n });\n\n try {\n const emailAttachments: EmailAttachment[] = email.attachments.map(att => ({\n filename: att.filename,\n contentType: att.contentType,\n content: att.content,\n size: att.size\n }));\n\n processedImages = await processEmailAttachments(emailAttachments, authorEmail, slug);\n console.log('✅ Processed images from email attachments:', {\n imageCount: processedImages.length,\n images: processedImages.map(img => ({\n filename: img.filename,\n originalFilename: img.original_filename,\n mimeType: img.mime_type\n }))\n });\n\n // Replace image references in content with proper URLs\n if (processedImages.length > 0) {\n const originalContent = content;\n content = replaceImageReferencesInContent(content, processedImages);\n \n if (content !== originalContent) {\n console.log('🔄 Updated content with image references');\n }\n }\n } catch (imageError) {\n console.error('❌ Error processing email attachments:', {\n error: imageError.message,\n stack: imageError.stack\n });\n // Continue with post creation even if image processing fails\n }\n } else {\n console.log('📎 No email attachments found');\n }\n\n // Generate verification token and expiration\n console.log('🔐 Generating verification token...');\n const verificationToken = generateVerificationToken();\n const expiresAt = getVerificationExpiration();\n console.log('✅ Verification token generated:', {\n tokenLength: verificationToken.length,\n expiresAt: expiresAt,\n expiresInHours: Math.round((new Date(expiresAt).getTime() - Date.now()) / (1000 * 60 * 60))\n });\n\n // Create draft post data\n const draftData: CreateDraftPostData = {\n title,\n slug,\n content,\n content_type: contentType,\n author_email: authorEmail,\n author_name: authorName,\n verification_token: verificationToken,\n expires_at: expiresAt\n };\n\n console.log('💾 Creating draft post in database...');\n const draftPost = await createDraftPost(draftData);\n console.log('✅ Draft post created:', { \n id: draftPost.id, \n title: draftPost.title, \n slug: draftPost.slug,\n verificationToken: draftPost.verification_token\n });\n\n console.log('📝 Creating email verification record...');\n await createEmailVerification(authorEmail, verificationToken, draftPost.id, expiresAt);\n console.log('✅ Email verification record created');\n\n console.log('📧 Sending verification email...');\n try {\n await sendVerificationEmail(authorEmail, verificationToken, title);\n console.log('✅ Verification email sent successfully');\n } catch (emailError) {\n console.error('❌ Failed to send verification email:', {\n error: emailError.message,\n stack: emailError.stack,\n recipientEmail: authorEmail,\n verificationToken: verificationToken\n });\n throw emailError;\n }\n\n const processingTime = Date.now() - startTime;\n console.log('🎉 EMAIL PROCESSING COMPLETED SUCCESSFULLY:', {\n processingTimeMs: processingTime,\n draftPostId: draftPost.id,\n verificationToken: verificationToken,\n recipientEmail: authorEmail\n });\n\n } catch (error) {\n const processingTime = Date.now() - startTime;\n console.error('💥 EMAIL PROCESSING FAILED:', {\n error: error.message,\n stack: error.stack,\n processingTimeMs: processingTime,\n emailFrom: email?.from,\n emailSubject: email?.subject\n });\n throw error;\n } finally {\n console.log('=== EMAIL PROCESSING END ===');\n }\n}",[203],"a4496ed6-69a3-11f0-aa22-0224a6c84d84","deno.json","0198439f-c37b-732a-a383-f406cbe654af",["D",1753481200444],"{\n \"$schema\": \"https://raw.githubusercontent.com/denoland/deno/348900b8b79f4a434cab4c74b3bc8d4d2fa8ee74/cli/schemas/config-file.v1.json\",\n \"lock\": false,\n \"compilerOptions\": {\n \"noImplicitAny\": false,\n \"strict\": false,\n \"types\": [\n \"https://www.val.town/types/valtown.d.ts\"\n ],\n \"lib\": [\n \"dom\",\n \"dom.iterable\",\n \"dom.asynciterable\",\n \"deno.ns\",\n \"deno.unstable\"\n ]\n },\n \"lint\": {\n \"files\": {\n \"include\": [\n \"deno:/https/esm.town/**/*\"\n ]\n },\n \"rules\": {\n \"exclude\": [\n \"no-explicit-any\"\n ]\n }\n },\n \"node_modules_dir\": false,\n \"experimental\": {\n \"unstable-node-globals\": true,\n \"unstable-temporal\": true,\n \"unstable-worker-options\": true,\n \"unstable-sloppy-imports\": true\n }\n}",[210],"a449624c-69a3-11f0-aa22-0224a6c84d84","debug-signatures.ts","0198439f-c37b-732a-a383-f1889a5dc868",["D",1753481200444],"/**\n * Debug HTTP Signatures - Detailed Analysis\n * \n * This script provides detailed debugging information about HTTP signature creation\n * to help identify why Mastodon verification is failing.\n * \n * ⚠️ DEVELOPMENT ONLY - This endpoint is only accessible when:\n * - NODE_ENV=development, OR\n * - DEV_MODE=true, OR \n * - ENABLE_TEST_ENDPOINTS=true\n */\n\nimport { createActivityPubHeaders, createDigest, getPublicKeyPem } from \"./backend/services/http-signatures.ts\";\nimport { devOnly } from \"./shared/utils.ts\";\n\nexport default async function debugSignatures() {\n return devOnly(async () => {\n try {\n console.log('🔍 === HTTP SIGNATURES DEBUG SESSION ===');\n \n // Test parameters (similar to what would be sent to Mastodon)\n const testInboxUrl = 'https://status.kinlan.me/inbox';\n const actorBaseUrl = 'https://posthero.us';\n const testActivity = {\n '@context': [\n 'https://www.w3.org/ns/activitystreams',\n 'https://w3id.org/security/v1'\n ],\n type: 'Create',\n id: `${actorBaseUrl}/post/test-post#create`,\n actor: `${actorBaseUrl}/actor`,\n object: {\n type: 'Note',\n id: `${actorBaseUrl}/post/test-post#activity`,\n attributedTo: `${actorBaseUrl}/actor`,\n content: '

Test Post

This is a test post for debugging HTTP signatures.

',\n published: new Date().toISOString(),\n to: ['https://www.w3.org/ns/activitystreams#Public'],\n cc: [`${actorBaseUrl}/followers`],\n url: `${actorBaseUrl}/post/test-post`\n },\n published: new Date().toISOString(),\n to: ['https://www.w3.org/ns/activitystreams#Public'],\n cc: [`${actorBaseUrl}/followers`]\n };\n \n const body = JSON.stringify(testActivity);\n \n console.log('\\n📋 REQUEST DETAILS:');\n console.log(`Target Inbox: ${testInboxUrl}`);\n console.log(`Actor Base URL: ${actorBaseUrl}`);\n console.log(`Body Length: ${body.length} characters`);\n \n // Generate headers\n console.log('\\n🔐 GENERATING HTTP SIGNATURE HEADERS...');\n const headers = await createActivityPubHeaders('POST', testInboxUrl, body, actorBaseUrl);\n \n console.log('\\n📤 GENERATED HEADERS:');\n Object.entries(headers).forEach(([key, value]) => {\n console.log(`${key}: ${value}`);\n });\n \n // Parse and analyze signature\n if (headers['Signature']) {\n console.log('\\n🔍 SIGNATURE ANALYSIS:');\n const sigParts = headers['Signature'].split(',').reduce((acc, part) => {\n const [key, value] = part.split('=');\n acc[key.trim()] = value.replace(/\"/g, '');\n return acc;\n }, {} as Record);\n \n console.log(`Key ID: ${sigParts.keyId}`);\n console.log(`Algorithm: ${sigParts.algorithm}`);\n console.log(`Headers: ${sigParts.headers}`);\n console.log(`Signature Length: ${sigParts.signature?.length || 0} characters`);\n \n // Reconstruct signing string\n const urlObj = new URL(testInboxUrl);\n const signingString = [\n `(request-target): post ${urlObj.pathname}`,\n `host: ${urlObj.host}`,\n `date: ${headers['Date']}`,\n `digest: ${headers['Digest']}`\n ].join('\\n');\n \n console.log('\\n📝 SIGNING STRING:');\n console.log(signingString);\n }\n \n // Get public key for verification\n console.log('\\n🔑 PUBLIC KEY ANALYSIS:');\n const publicKeyPem = await getPublicKeyPem();\n console.log(`Public Key Length: ${publicKeyPem.length} characters`);\n console.log(`Key Format Valid: ${publicKeyPem.includes('-----BEGIN PUBLIC KEY-----') && publicKeyPem.includes('-----END PUBLIC KEY-----')}`);\n \n return new Response(`\n\n\n\n HTTP Signatures Debug Results\n \n\n\n

🔍 HTTP Signatures Debug Results

\n \n

📋 Request Details

Target Inbox: ${testInboxUrl}

Actor Base URL: ${actorBaseUrl}

Body Length: ${body.length} characters

\n\n

📤 Generated Headers

\n ${Object.entries(headers).map(([key, value]) => \n `

${key}: ${key === 'Signature' ? value.substring(0, 100) + '...' : value}

`\n ).join('')}\n

\n\n

🔐 Signature Components

Uses RSA-SHA256: ${headers['Signature']?.includes('rsa-sha256') ? '✅ YES' : '❌ NO'}

Includes Digest: ${!!headers['Digest'] ? '✅ YES' : '❌ NO'}

Includes Date: ${!!headers['Date'] ? '✅ YES' : '❌ NO'}

Correct Header Order: ${headers['Signature']?.includes('(request-target) host date digest') ? '✅ YES' : '❌ NO'}

\n\n

🐘 Mastodon Compatibility

Uses RSA-SHA256: ${headers['Signature']?.includes('rsa-sha256') ? '✅ YES' : '❌ NO'}

Includes Digest: ${!!headers['Digest'] ? '✅ YES' : '❌ NO'}

Includes Date: ${!!headers['Date'] ? '✅ YES' : '❌ NO'}

Correct Header Order: ${headers['Signature']?.includes('(request-target) host date digest') ? '✅ YES' : '❌ NO'}

\n\n

📝 Signing String

${headers['Signature'] ? (() => {\n const urlObj = new URL(testInboxUrl);\n return [\n `(request-target): post ${urlObj.pathname}`,\n `host: ${urlObj.host}`,\n `date: ${headers['Date']}`,\n `digest: ${headers['Digest']}`\n ].join('\\\\n');\n })() : 'No signature found'}

\n\n

🔧 Next Steps

Compare the signing string with Mastodon's expectations
Verify the public key is accessible at the keyId URL
Check if the signature algorithm matches Mastodon's requirements
Ensure the date format is RFC 2822 compliant

\n\n\n `, {\n headers: {\n 'Content-Type': 'text/html',\n },\n });\n\n } catch (error) {\n console.error('❌ Debug failed:', error);\n return new Response(`\n\n\n\n Debug Error\n \n\n\n

❌ Debug Session Failed

\n Error: ${error.message}\n

Check the console logs for more details.

\n\n\n `, {\n headers: {\n 'Content-Type': 'text/html',\n },\n status: 500,\n });\n }\n });\n}",[216],"a4495a86-69a3-11f0-aa22-0224a6c84d84","debug-config.ts",["D",1753481200444],"/**\n * Debug configuration tool - HTTP endpoint to check email security settings\n * \n * ⚠️ DEVELOPMENT ONLY - This endpoint is only accessible when:\n * - NODE_ENV=development, OR\n * - DEV_MODE=true, OR \n * - ENABLE_TEST_ENDPOINTS=true\n */\n\nimport { Hono } from \"https://esm.sh/hono@3.11.7\";\nimport { isEmailAllowed } from \"./backend/services/email-security.ts\";\nimport { isDevelopmentMode } from \"./shared/utils.ts\";\n\nconst app = new Hono();\n\n// Development-only middleware\napp.use(\"*\", async (c, next) => {\n if (!isDevelopmentMode()) {\n return c.text('Not Found', 404);\n }\n await next();\n});\n\napp.get(\"/\", async (c) => {\n const testEmail = c.req.query(\"email\");\n \n // Get environment variables\n const allowedEmails = Deno.env.get('ALLOWED_EMAIL_ADDRESSES');\n const baseUrl = Deno.env.get('BASE_URL');\n \n // Parse allowed emails\n let allowedList: string[] = [];\n if (allowedEmails) {\n allowedList = allowedEmails\n .split(',')\n .map(email => email.trim().toLowerCase())\n .filter(email => email.length > 0);\n }\n \n // Test email if provided\n let emailTestResult = null;\n if (testEmail) {\n emailTestResult = {\n testEmail: testEmail,\n normalizedEmail: testEmail.trim().toLowerCase(),\n isAllowed: isEmailAllowed(testEmail),\n matchesAny: allowedList.includes(testEmail.trim().toLowerCase())\n };\n }\n \n const html = `\n\n\n\n \n \n Email Blog Debug Configuration\n \n\n\n

📧 Email Blog Debug Configuration

\n \n

Development Mode Active

This debug interface is only accessible in development mode. In production, this endpoint returns 404.

\n \n

🔧 Environment Variables

\n ALLOWED_EMAIL_ADDRESSES:\n

\n ${allowedEmails || 'NOT SET'}\n

\n ${!allowedEmails ? '

⚠️ This must be set for emails to be processed!

' : ''}\n

\n BASE_URL:\n

\n ${baseUrl || 'NOT SET (will auto-detect)'}\n

\n\n \n

📋 Parsed Configuration

\n Allowed Email Count: ${allowedList.length}\n

\n Allowed Emails (normalized):\n

✅ ${email}
❌ No emails configured

\n\n \n

🧪 Test Email Address

\n \n \n ${emailTestResult ? `\n

\n ${emailTestResult.isAllowed ? '✅ Email ALLOWED' : '❌ Email BLOCKED'}\n

Original: ${emailTestResult.testEmail}

Normalized: ${emailTestResult.normalizedEmail}

Matches allowlist: ${emailTestResult.matchesAny ? 'Yes' : 'No'}

\n ` : ''}\n

\n\n \n

📝 Setup Instructions

1. Set Environment Variable:

\n ALLOWED_EMAIL_ADDRESSES=user1@example.com,user2@example.com\n

\n \n

2. Send Test Email:

Send from an allowed email address
Subject becomes the post title
Body becomes the post content
You'll receive a verification email

\n \n

3. Check Logs:

Use the requests tool to see detailed logs of email processing.

\n\n\n `;\n \n return c.html(html);\n});\n\nexport default app.fetch;",[222],"a44956f8-69a3-11f0-aa22-0224a6c84d84","SETUP.md","0198439f-c37b-732a-a383-e9423cfb5ad8",["D",1753481200444],"# Email Blog Platform Setup Guide\n\n## Quick Start\n\nYour email blog platform is now ready to use! Here's how to get started:\n\n### 1. Email Publishing\n\nTo publish a blog post, simply send an email to your Val Town email address:\n\n- **Subject**: Becomes the post title\n- **Body**: Becomes the post content (HTML preferred, plain text will be converted)\n- **From**: Becomes the author information\n\nExample email:\n```\nTo: your-email-val@val.town\nSubject: My First Blog Post\nBody:

Hello World!

This is my first post published via email!

\n```\n\n### 2. Accessing Your Blog\n\n- **Main Blog**: Visit your backend HTTP val URL\n- **Individual Posts**: `/post/[slug]` (auto-generated from title)\n- **RSS Feed**: `/rss`\n- **API**: `/api/posts` for JSON data\n\n### 3. Current Features\n\n✅ **Core Features**\n- Email-to-publish functionality\n- HTML and plain text support\n- Automatic slug generation\n- SQLite database storage\n- RSS 2.0 feed\n- Responsive web interface\n- SEO-friendly URLs\n- Social media meta tags\n\n✅ **Technical Features**\n- Static HTML generation (no client-side JavaScript)\n- Hono backend API\n- TailwindCSS styling\n- Error handling and logging\n- Fast loading and SEO optimized\n\n### 4. Federation & Syndication Setup\n\nThe platform includes foundation code for:\n\n#### WebSub (PubSubHubbub)\n- Set `WEBSUB_HUB_URL` environment variable\n- Endpoint: `/websub` for subscription management\n- Automatically notifies subscribers of new posts\n\n#### ActivityPub (Mastodon, etc.)\n- Set `BASE_URL` environment variable to your domain\n- **For production use**: Generate RSA keys for HTTP signatures\n 1. Visit `/generate-keys.ts` to generate keys\n 2. Set `ACTIVITYPUB_PUBLIC_KEY` and `ACTIVITYPUB_PRIVATE_KEY` environment variables\n 3. Restart your val\n- Actor endpoint: `/actor`\n- Inbox endpoint: `/inbox`\n- Full federation support with followers, likes, and shares\n\n#### AT Protocol (Bluesky)\n- Set `ATPROTO_HANDLE` and `ATPROTO_PASSWORD` environment variables\n- Automatically cross-posts to Bluesky when publishing\n\n### 5. Environment Variables\n\nOptional configuration:\n\n```bash\n# Base URL for your blog (required for custom domains and ActivityPub)\nBASE_URL=https://your-domain.com\n\n# WebSub Hub URL (e.g., https://pubsubhubbub.appspot.com/)\nWEBSUB_HUB_URL=your-hub-url\n\n# AT Protocol (Bluesky) credentials\nATPROTO_HANDLE=your-handle.bsky.social\nATPROTO_PASSWORD=your-app-password\n\n# ActivityPub HTTP Signatures (recommended for production)\nACTIVITYPUB_PUBLIC_KEY=-----BEGIN PUBLIC KEY-----...\nACTIVITYPUB_PRIVATE_KEY=-----BEGIN PRIVATE KEY-----...\n```\n\n**To generate ActivityPub keys:**\n1. Visit `/generate-keys.ts` in your browser\n2. Copy the generated keys to your environment variables\n3. Restart your val for changes to take effect\n\n### 6. Customization\n\n#### Styling\n- Edit CSS in the `getCustomCSS()` function in `/backend/index.ts`\n- Uses TailwindCSS classes throughout\n- Modify HTML generation functions for layout changes\n\n#### Branding\n- Update blog title and description in HTML generation functions\n- Change favicon in HTML templates\n- Modify footer text in `generateBlogHTML()` and `generatePostHTML()`\n\n#### Database Schema\n- Posts are stored in SQLite table `blog_posts_v1`\n- To modify schema, create new table name (e.g., `blog_posts_v2`)\n\n### 7. Testing\n\nUse the `/test-publish.ts` val to create sample posts for testing.\n\n### 8. Monitoring\n\n- Check Val Town logs for email processing\n- Use `/health` endpoint for status checks\n- Monitor `/api/posts` for data integrity\n\n## Architecture Overview\n\n```\nEmail → email.ts (Email Trigger)\n ↓\n Database (SQLite)\n ↓\n backend/index.ts (HTTP API + HTML Generation)\n ↓\n Static HTML (TailwindCSS)\n```\n\n## Next Steps\n\n1. **Set up email forwarding** to your Val Town email address\n2. **Configure environment variables** for federation features\n3. **Customize styling** and branding to match your preferences\n4. **Test email publishing** with different content types\n5. **Share your RSS feed** for syndication\n\n## Support\n\n- Check Val Town logs for debugging\n- Use the `/health` endpoint to verify system status\n- Test individual components using the API endpoints\n\nYour email blog platform is ready to use! Send your first email to start publishing.",[227],"a4495112-69a3-11f0-aa22-0224a6c84d84","SECURITY.md","0198439f-c37b-732a-a383-e6a9f575d323",["D",1753481200444],"# Email Blog Security Configuration\n\n## Overview\n\nThe email blog platform includes robust security features to prevent unauthorized posting and email spoofing. This guide explains how to configure and use these security features.\n\n## Required Configuration\n\n### 1. Set Allowed Email Addresses\n\nConfigure the `ALLOWED_EMAIL_ADDRESSES` environment variable with a comma-separated list of email addresses that are allowed to publish posts:\n\n```bash\nALLOWED_EMAIL_ADDRESSES=user1@example.com,user2@example.com,admin@myblog.com\n```\n\n**Important Notes:**\n- Email addresses are case-insensitive\n- Whitespace around commas is automatically trimmed\n- If this variable is not set, **no emails will be allowed**\n- Only exact email matches are allowed (no wildcards or domains)\n\n### 2. Set Base URL (Optional)\n\nSet your blog's base URL for verification links:\n\n```bash\nBASE_URL=https://your-blog.web.val.run\n```\n\nIf not set, the system will auto-detect the URL from incoming requests.\n\n## How Email Security Works\n\n### Step 1: Email Allowlist Check\nWhen an email is received:\n1. The sender's email address is checked against `ALLOWED_EMAIL_ADDRESSES`\n2. If not allowed, the email is ignored (logged but not processed)\n3. If allowed, the process continues to verification\n\n### Step 2: Draft Creation\nFor allowed emails:\n1. Post content is extracted from the email\n2. A draft post is created (not published yet)\n3. A unique verification token is generated\n4. The draft expires after 24 hours if not verified\n\n### Step 3: Verification Email\n1. An automated verification email is sent to the original sender\n2. The email contains a secure verification link\n3. The link expires after 24 hours for security\n\n### Step 4: Verification and Publishing\nWhen the sender clicks the verification link:\n1. The token is validated and checked for expiration\n2. The email verification is marked as complete\n3. The draft post is converted to a published post\n4. External services are notified (RSS, ActivityPub, etc.)\n5. The draft and verification records are cleaned up\n\n## Security Benefits\n\n### Anti-Spoofing Protection\n- **Email confirmation required**: Even if someone spoofs your email address, they can't access your email to click the verification link\n- **Time-limited tokens**: Verification links expire after 24 hours\n- **One-time use**: Each verification token can only be used once\n\n### Access Control\n- **Allowlist-based**: Only pre-approved email addresses can publish\n- **No wildcards**: Exact email matching prevents subdomain attacks\n- **Easy management**: Add/remove allowed emails via environment variable\n\n### Automatic Cleanup\n- **Expired drafts**: Unverified drafts are automatically deleted after 24 hours\n- **Token cleanup**: Used and expired verification tokens are removed\n- **Database efficiency**: Regular cleanup prevents database bloat\n\n## Email Templates\n\n### Verification Email Template\nThe system sends a professional verification email with:\n- Clear subject line indicating verification needed\n- HTML and plain text versions\n- Secure verification link\n- Expiration warning (24 hours)\n- Instructions for non-senders to ignore\n\n### Example Verification Email\n```\nSubject: Verify your blog post: My Amazing Blog Post\n\nHello,\n\nWe received a blog post submission with the title \"My Amazing Blog Post\" from this email address.\n\nTo confirm that you sent this post and publish it to the blog, please click the verification link below:\n\n[Verify and Publish Post]\n\nImportant: This verification link will expire in 24 hours for security reasons.\n\nIf you did not send this blog post, please ignore this email.\n```\n\n## Troubleshooting\n\n### Email Not Processing\n1. **Check allowlist**: Ensure sender email is in `ALLOWED_EMAIL_ADDRESSES`\n2. **Check logs**: Look for \"Email from X is not in the allowed list\" messages\n3. **Verify format**: Ensure environment variable is properly formatted\n\n### Verification Link Issues\n1. **Check expiration**: Links expire after 24 hours\n2. **Check BASE_URL**: Ensure it's set correctly or auto-detection is working\n3. **One-time use**: Each link can only be used once\n\n### Posts Not Publishing\n1. **Click verification link**: Posts remain as drafts until verified\n2. **Check email delivery**: Ensure verification emails aren't in spam\n3. **Check token validity**: Tokens expire after 24 hours\n\n## Best Practices\n\n### Email Management\n- Use dedicated email addresses for blog posting\n- Keep the allowlist minimal (only trusted users)\n- Regularly review who has posting access\n\n### Security Monitoring\n- Monitor logs for unauthorized posting attempts\n- Review verification patterns for unusual activity\n- Keep environment variables secure\n\n### Backup Strategy\n- Regular database backups include draft posts\n- Consider notification systems for failed verifications\n- Document your allowed email addresses\n\n## API Endpoints\n\n### Verification Endpoint\n- **URL**: `GET /verify-email?token=`\n- **Purpose**: Handles email verification and post publishing\n- **Responses**:\n - `200`: Successful verification and publishing\n - `400`: Missing or invalid token\n - `404`: Token not found\n - `410`: Token expired\n - `500`: Server error during publishing\n\n### Security Headers\nAll verification pages include:\n- Proper HTML escaping to prevent XSS\n- Responsive design for mobile verification\n- Clear success/error messaging\n- Links back to the main blog\n\n## Migration from Unsecured Version\n\nIf upgrading from a version without security:\n\n1. **Set environment variables** before receiving new emails\n2. **Existing posts** remain published (not affected)\n3. **New emails** will require verification from the first email received\n4. **Test thoroughly** with a test email before going live\n\n---\n\n**Security is enabled by default. Configure `ALLOWED_EMAIL_ADDRESSES` to start receiving posts!**",[233],"a4494582-69a3-11f0-aa22-0224a6c84d84","README.md","0198439f-c37b-732a-a383-e151a0dc0fc0",["D",1753481200444],"# Email Blog Platform\n\nA modern blog platform inspired by Posterous that allows publishing posts via email.\n\n## 🚀 Status: READY TO USE\n\nYour email blog platform is fully functional! Send an email to start publishing.\n\n## ✨ Features\n\n- **📧 Email-to-Publish**: Send an email to publish posts instantly\n- **🔒 Email Security**: Allowlist and verification system to prevent unauthorized posts\n- **🎨 Multi-format Support**: HTML and plain text posts\n- **🖼️ Image Storage**: Upload images via web interface or email attachments with automatic processing\n- **📡 RSS Feed**: Full RSS 2.0 support for syndication\n- **🌐 WebSub**: Real-time feed updates via WebSub protocol (configured)\n- **🐘 ActivityPub**: Full federated social networking with followers, likes, and shares ✅\n - Content negotiation for HTML/JSON responses\n - Actor profile accessible from browsers and ActivityPub clients\n- **🦋 AT Protocol**: Bluesky integration for cross-platform syndication (configured)\n- **🔗 SEO Friendly**: Clean URLs with slugified titles\n- **📱 Responsive Design**: Mobile-first responsive interface with TailwindCSS\n- **⚡ Fast**: Built on Val Town with SQLite storage and static HTML generation\n- **🚀 No JavaScript**: Pure HTML/CSS frontend for maximum performance\n\n## 🏗️ Architecture\n\n### Backend (`/backend/`)\n- `index.ts` - Main Hono server with HTML generation and API routes ✅\n- `database/` - SQLite schema and query functions ✅\n- `services/` - External service integrations ✅\n\n### Email Handler (`/email.ts`)\n- Email trigger handler with security verification ✅\n- Allowlist checking and draft post creation ✅\n- Automated verification email sending ✅\n\n### Static HTML Generation\n- Server-side HTML rendering with TailwindCSS ✅\n- No client-side JavaScript dependencies ✅\n- Fast loading and SEO optimized ✅\n\n## 🎯 Quick Start\n\n1. **Configure Security**: Set `ALLOWED_EMAIL_ADDRESSES` environment variable (see Security section)\n2. **Send Email**: Send email from an allowed address to your Val Town email address\n3. **Verify Email**: Click the verification link sent to your email\n4. **View Blog**: Visit your backend HTTP val URL after verification\n5. **RSS Feed**: Access `/rss` for syndication\n6. **Individual Posts**: Visit `/post/[slug]`\n\n## 🔧 Configuration\n\nSee [SETUP.md](./SETUP.md) for detailed setup instructions and [ACTIVITYPUB.md](./ACTIVITYPUB.md) for ActivityPub federation details.\n\n### Environment Variables (Required for Security)\n\n- `ALLOWED_EMAIL_ADDRESSES` - Comma-separated list of allowed email addresses (required for email publishing)\n- `BASE_URL` - Your blog's base URL (e.g., https://myblog.com or just myblog.com) - **Required for custom domains and ActivityPub federation**\n- `UPLOAD_PASSWORD` - Password required for image uploads (required to enable image upload functionality)\n\n### Environment Variables (Optional)\n\n- `WEBSUB_HUB_URL` - WebSub hub URL\n- `ACTIVITYPUB_DOMAIN` - Domain for ActivityPub federation (deprecated - use BASE_URL instead)\n- `ATPROTO_HANDLE` - AT Protocol handle\n- `ATPROTO_PASSWORD` - AT Protocol app password\n- `ADMIN_PASSWORD` - Admin password for advanced features (falls back to UPLOAD_PASSWORD if not set)\n\n### Environment Variables (Required for ActivityPub HTTP Signatures)\n\nFor proper ActivityPub federation with HTTP signatures (recommended for production):\n\n- `ACTIVITYPUB_PUBLIC_KEY` - RSA public key in PEM format\n- `ACTIVITYPUB_PRIVATE_KEY` - RSA private key in PEM format\n\n**To generate these keys:**\n1. Visit `/generate-keys.ts` (your key generator val)\n2. Copy the generated keys to your environment variables\n3. Restart your val\n\nWithout these keys, the system will generate temporary keys that change on restart, which may cause federation issues.\n\n## 🧪 Development Mode & Testing\n\nThe platform includes several testing and debugging endpoints that are **only accessible in development mode** for security.\n\n### Enabling Development Mode\n\nSet one of these environment variables to enable testing endpoints:\n\n- `NODE_ENV=development`\n- `DEV_MODE=true` \n- `ENABLE_TEST_ENDPOINTS=true`\n\n### Available Test Endpoints\n\nWhen development mode is enabled, you can access:\n\n- **`/test-activitypub.ts`** - Test ActivityPub and WebFinger endpoints\n- **`/test-publish.ts`** - Create a test blog post\n- **`/test-follow.ts`** - Test Follow activity processing\n- **`/test-verification.ts`** - Test email verification flow\n- **`/test-http-signatures.ts`** - Test HTTP signatures implementation\n- **`/test-activitypub-inbox.ts`** - Test ActivityPub inbox functionality\n- **`/test-activitypub-delivery.ts`** - Test ActivityPub delivery with HTTP signatures\n- **`/debug-config.ts`** - Debug email security configuration\n- **`/debug-signatures.ts`** - Debug HTTP signatures in detail\n- **`/generate-keys.ts`** - Generate RSA keys for ActivityPub\n\n### Production Security\n\nIn production (when development mode is disabled), all test endpoints return a 404 response, ensuring your production environment remains secure while allowing full testing capabilities during development.\n\n### Custom Domain Setup\n\nTo use a custom domain with ActivityPub federation:\n\n1. **Set up your custom domain** in Val Town (see Val Town documentation)\n2. **Set the BASE_URL environment variable** to your custom domain:\n - `BASE_URL=https://yourdomain.com` (with protocol)\n - OR `BASE_URL=yourdomain.com` (protocol will be assumed as https)\n3. **Test ActivityPub discovery** by visiting `https://yourdomain.com/.well-known/webfinger?resource=acct:blog@yourdomain.com`\n\nWithout BASE_URL set, the system will use the default Val Town URL for ActivityPub federation.\n\n## 📊 API Endpoints\n\n- `GET /` - Main blog interface (with ActivityPub Link header)\n- `GET /post/:slug` - Individual post page (supports content negotiation for ActivityPub)\n- `GET /upload` - Image upload interface ✅\n- `GET /images/:filename` - Serve uploaded images ✅\n- `GET /rss` - RSS 2.0 feed\n- `GET /api/posts` - JSON API for posts\n- `GET /api/posts/:slug` - JSON API for single post\n- `POST /api/images/upload` - Upload image endpoint ✅\n- `GET /api/posts/:slug/images` - Get images for a specific post ✅\n- `GET /api/images/user/:email` - Get images uploaded by a user ✅\n- `GET /api/images` - Get all images (admin endpoint) ✅\n- `DELETE /api/images/:filename` - Delete an image ✅\n- `GET /websub` - WebSub subscription endpoint\n- `GET /.well-known/webfinger` - WebFinger discovery for ActivityPub ✅\n- `GET /actor` - ActivityPub actor document with rich metadata ✅\n- `GET /outbox` - ActivityPub outbox (paginated published activities) ✅\n- `GET /outbox?page=N` - Paginated outbox pages ✅\n- `GET /followers` - ActivityPub followers collection (with pagination support) ✅\n- `GET /followers-list` - Human-readable followers page ✅\n- `GET /api/followers` - JSON API for followers list ✅\n- `GET /following` - ActivityPub following collection ✅\n- `POST /inbox` - ActivityPub inbox (processes Follow, Like, Announce, Undo) ✅\n- `GET /api/posts/:slug/activities` - Get activity counts (likes, shares, replies) ✅\n- `GET /verify-email` - Email verification endpoint ✅\n- `GET /health` - Health check\n\n## 🔒 Security Features\n\n### Email Allowlist\nOnly emails from pre-configured addresses can publish posts. Configure via environment variable:\n\n```\nALLOWED_EMAIL_ADDRESSES=user1@example.com,user2@example.com,admin@myblog.com\n```\n\n### Email Verification\nTo prevent spoofing, all emails go through a verification process:\n\n1. **Email Received**: Email is stored as a draft (not published)\n2. **Verification Sent**: Automated verification email sent to sender\n3. **User Clicks Link**: Sender clicks verification link in email\n4. **Post Published**: After verification, post is published and syndicated\n\n### Security Benefits\n- **Anti-spoofing**: Prevents unauthorized users from publishing posts\n- **Email confirmation**: Ensures the sender actually sent the email\n- **Time-limited**: Verification links expire after 24 hours\n- **Automatic cleanup**: Expired drafts are automatically removed\n\n## 🖼️ Image Storage & Management\n\nThe platform includes comprehensive image storage capabilities for both static assets and email attachments.\n\n### Image Upload Methods\n\n1. **Web Interface**: Visit `/upload` (requires UPLOAD_PASSWORD) to upload images via drag-and-drop interface\n2. **Email Attachments**: Images attached to blog post emails are automatically processed and stored\n\n### Supported Image Formats\n\n- JPEG/JPG\n- PNG \n- GIF\n- WebP\n- SVG\n\n**File Size Limit**: 5MB per image\n\n### Image Storage Features\n\n- **Password Protection**: Upload interface protected by UPLOAD_PASSWORD environment variable\n- **Automatic Processing**: Email attachments are automatically extracted and stored\n- **Content Reference Replacement**: Image references in email content are automatically updated to use stored URLs\n- **Metadata Storage**: Original filename, MIME type, file size, alt text, and post associations\n- **Secure Access**: Password-protected upload system prevents unauthorized access\n- **Blob Storage**: Images stored using Val Town's blob storage with unique filenames\n- **URL Generation**: Clean `/images/filename` URLs for serving images\n\n### Image API Usage\n\n```javascript\n// Upload an image (requires password)\nconst formData = new FormData();\nformData.append('image', file);\nformData.append('password', 'your-upload-password');\nformData.append('email', 'your-email@example.com');\nformData.append('altText', 'Description of image');\nformData.append('postSlug', 'my-blog-post'); // optional\n\nconst response = await fetch('/api/images/upload', {\n method: 'POST',\n body: formData\n});\n\n// Get images for a post (no password required)\nconst images = await fetch('/api/posts/my-post-slug/images').then(r => r.json());\n\n// Get images by user (requires password)\nconst userImages = await fetch('/api/images/user/user@example.com?password=your-upload-password').then(r => r.json());\n\n// Get all images (requires password)\nconst allImages = await fetch('/api/images?password=your-upload-password&limit=50').then(r => r.json());\n```\n\n### Email Attachment Processing\n\nWhen you send an email with image attachments:\n\n1. **Automatic Detection**: System identifies image attachments by MIME type\n2. **Storage**: Images are stored with unique filenames in blob storage\n3. **Database Records**: Metadata is saved linking images to the post\n4. **Content Updates**: Email content is updated to reference stored image URLs\n5. **Reference Replacement**: Common patterns like `cid:image.jpg` are replaced with proper URLs\n\nExample email with attachment:\n```\nTo: your-blog@val.town\nFrom: author@example.com\nSubject: My Post with Images\nAttachments: photo.jpg, diagram.png\n\n

Check out this photo:

\n $\"My$ \n

And this diagram: [diagram.png]

\n```\n\nAfter processing, the content becomes:\n```html\n

Check out this photo:

\n $\"My$ \n

And this diagram: ![diagram.png](/images/1234567890-def456-diagram.png)

\n```\n\n## 🧪 Testing\n\nUse `/test-publish.ts` to create sample posts for testing.\n\n## 📝 Usage Example\n\nSend an email like this:\n\n```\nTo: your-email-val@val.town\nFrom: allowed-user@example.com (must be in ALLOWED_EMAIL_ADDRESSES)\nSubject: My Amazing Blog Post\nBody:

Hello World!

This post was published via email!

\n```\n\nThe process will be:\n1. Email received and stored as draft\n2. Verification email sent to `allowed-user@example.com`\n3. User clicks verification link\n4. Post published with:\n - Title: \"My Amazing Blog Post\"\n - Slug: \"my-amazing-blog-post\"\n - Content: Rendered HTML\n - Author: Extracted from email address\n\n## 🎨 Customization\n\n- Edit HTML generation functions in `/backend/index.ts`\n- Modify CSS styles in the `getCustomCSS()` function\n- Update branding in HTML templates\n- Configure federation services via environment variables\n\n## 🔄 Syndication\n\nPosts are automatically syndicated to:\n- RSS feed (always enabled)\n- WebSub subscribers (if configured)\n- ActivityPub followers (with full interaction support) ✅\n- AT Protocol/Bluesky (if configured)\n\n### ActivityPub Federation\n\nYour blog is now fully federated with ActivityPub! Users can:\n\n- **Follow** your blog from Mastodon, Pleroma, and other ActivityPub platforms\n- **Like** your blog posts (shows ❤️ count on posts)\n- **Share/Boost** your posts (shows 🔄 count on posts)\n- **Reply** to your posts (shows 💬 count on posts)\n- **Preview posts** directly in Mastodon timeline with proper formatting\n\n**Discovery formats:**\n- **WebFinger**: `@blog@your-domain.com`\n- **Direct actor URL**: `https://your-domain.com/actor`\n\n**Configuration for custom domains:**\n- Set `BASE_URL=https://your-custom-domain.com` in your environment variables\n- This ensures all ActivityPub URLs use your custom domain instead of the default Val Town URL\n\n**Enhanced ActivityPub Features:**\n- ✅ **Paginated Outbox**: Posts are served with proper pagination for better performance\n- ✅ **Rich Post Previews**: Posts display with titles, summaries, and full content in Mastodon\n- ✅ **Content Negotiation**: Individual posts serve both HTML and ActivityPub JSON based on Accept headers\n- ✅ **Profile Metadata**: Actor profile includes avatar, header image, and custom fields\n- ✅ **Link Discovery**: Proper HTTP Link headers for ActivityPub discovery\n- ✅ **Post Permalinks**: Each post has its own ActivityPub Note endpoint\n\n**Real-time interaction tracking:**\n- All likes, shares, and replies are stored and displayed on individual post pages\n- Follower count is maintained and accurate\n- Full ActivityPub inbox processing for Follow/Unfollow activities\n\nExample: If your blog is at `myblog.com` (with `BASE_URL=https://myblog.com`), users can follow `@blog@myblog.com` from their Mastodon client and see your posts with rich previews in their timeline!\n\n---\n\n**Ready to blog via email? Send your first post now!** 📧✨",[239],"a4493cfe-69a3-11f0-aa22-0224a6c84d84","ACTIVITYPUB.md","0198439f-c37b-732a-a383-ddf8910531e9",["D",1753481200444],"# ActivityPub Implementation Guide\n\nThis document explains the ActivityPub and WebFinger implementation in the Email Blog platform.\n\n## 🌐 Overview\n\nActivityPub is a decentralized social networking protocol that allows your blog to be discovered and followed from Mastodon, Pleroma, and other federated social networks. WebFinger is the discovery mechanism that allows users to find your blog using familiar `@username@domain.com` syntax.\n\n## ✅ Implemented Features\n\n### WebFinger Discovery\n- **Endpoint**: `/.well-known/webfinger`\n- **Formats Supported**:\n - `acct:blog@your-domain.com`\n - `https://your-domain.com/actor`\n- **Response**: JSON Resource Descriptor (JRD) format\n- **CORS**: Enabled for cross-origin requests\n\n### ActivityPub Actor\n- **Endpoint**: `/actor`\n- **Type**: Person\n- **Username**: `blog`\n- **Content Negotiation**: \n - `application/activity+json` → ActivityPub JSON document\n - `application/ld+json` → ActivityPub JSON document \n - `text/html` → Human-readable profile page\n- **Discovery**: Linked from home page with `rel=\"alternate\"`\n\n### Home Page Content Negotiation\n- **Endpoint**: `/`\n- **Content Negotiation**:\n - `text/html` → Blog homepage with posts\n - `application/activity+json` → ActivityPub actor document\n - `application/ld+json` → ActivityPub actor document\n- **Discovery**: Includes Link header pointing to `/actor`\n\n### ActivityPub Collections\n- **Outbox** (`/outbox`): Published blog posts as ActivityPub Create activities\n- **Followers** (`/followers`): Collection of active followers (real data)\n- **Following** (`/following`): Collection of accounts being followed (placeholder)\n- **Inbox** (`/inbox`): Processes ActivityPub activities (Follow, Unfollow, Like, Announce, Create)\n\n### Activity Processing\n- **Follow Activities**: Adds followers to database, sends Accept response\n- **Unfollow Activities**: Removes followers from database\n- **Like Activities**: Tracks likes per post, displays counts\n- **Announce Activities**: Tracks shares/boosts per post, displays counts\n- **Create Activities**: Tracks replies to posts, displays counts\n\n### Database Storage\n- **Followers Table**: Stores follower information (actor ID, username, domain, inbox, etc.)\n- **Activities Table**: Stores all received activities (likes, shares, replies)\n- **Activity Counts**: Real-time counting and display on post pages\n\n## 🔧 Configuration\n\n### Environment Variables\n\n```bash\n# Optional: Set a custom domain for ActivityPub\nACTIVITYPUB_DOMAIN=your-custom-domain.com\n```\n\nIf not set, the system will automatically detect the domain from the request headers.\n\n## 🚀 Usage Examples\n\n### Following from Mastodon\n\n1. **Using WebFinger format**: Search for `@blog@your-domain.com` in your Mastodon client\n2. **Using direct URL**: Paste `https://your-domain.com/actor` in the search box\n\n### Testing WebFinger\n\n```bash\n# Test with acct format\ncurl \"https://your-domain.com/.well-known/webfinger?resource=acct:blog@your-domain.com\"\n\n# Test with direct URL format \ncurl \"https://your-domain.com/.well-known/webfinger?resource=https://your-domain.com/actor\"\n```\n\n### Testing ActivityPub Endpoints\n\n```bash\n# Get actor document\ncurl -H \"Accept: application/activity+json\" https://your-domain.com/actor\n\n# Get outbox (published posts)\ncurl -H \"Accept: application/activity+json\" https://your-domain.com/outbox\n\n# Get followers collection\ncurl -H \"Accept: application/activity+json\" https://your-domain.com/followers\n```\n\n## 📋 WebFinger Response Format\n\n```json\n{\n \"subject\": \"acct:blog@your-domain.com\",\n \"aliases\": [\n \"https://your-domain.com/actor\",\n \"https://your-domain.com/\"\n ],\n \"properties\": {\n \"http://schema.org/name\": \"Email Blog\"\n },\n \"links\": [\n {\n \"rel\": \"http://webfinger.net/rel/profile-page\",\n \"type\": \"text/html\",\n \"href\": \"https://your-domain.com/\"\n },\n {\n \"rel\": \"self\",\n \"type\": \"application/activity+json\",\n \"href\": \"https://your-domain.com/actor\"\n },\n {\n \"rel\": \"http://ostatus.org/schema/1.0/subscribe\",\n \"template\": \"https://your-domain.com/authorize_interaction?uri={uri}\"\n }\n ]\n}\n```\n\n## 📋 ActivityPub Actor Format\n\n```json\n{\n \"@context\": [\n \"https://www.w3.org/ns/activitystreams\",\n \"https://w3id.org/security/v1\"\n ],\n \"type\": \"Person\",\n \"id\": \"https://your-domain.com/actor\",\n \"preferredUsername\": \"blog\",\n \"name\": \"Email Blog\",\n \"summary\": \"A blog powered by email publishing\",\n \"url\": \"https://your-domain.com\",\n \"inbox\": \"https://your-domain.com/inbox\",\n \"outbox\": \"https://your-domain.com/outbox\",\n \"followers\": \"https://your-domain.com/followers\",\n \"following\": \"https://your-domain.com/following\",\n \"publicKey\": {\n \"id\": \"https://your-domain.com/actor#main-key\",\n \"owner\": \"https://your-domain.com/actor\",\n \"publicKeyPem\": \"-----BEGIN PUBLIC KEY-----\\\\n...\\\\n-----END PUBLIC KEY-----\"\n }\n}\n```\n\n## 🔄 How Posts Become Activities\n\nWhen you publish a blog post via email, it automatically becomes available in the ActivityPub outbox as a Create activity:\n\n```json\n{\n \"@context\": \"https://www.w3.org/ns/activitystreams\",\n \"type\": \"Create\",\n \"id\": \"https://your-domain.com/post/my-post#create\",\n \"actor\": \"https://your-domain.com/actor\",\n \"published\": \"2024-01-01T12:00:00Z\",\n \"object\": {\n \"type\": \"Note\",\n \"id\": \"https://your-domain.com/post/my-post#note\",\n \"attributedTo\": \"https://your-domain.com/actor\",\n \"content\": \"

My Post Title

Post content...

\",\n \"published\": \"2024-01-01T12:00:00Z\",\n \"url\": \"https://your-domain.com/post/my-post\",\n \"to\": [\"https://www.w3.org/ns/activitystreams#Public\"]\n }\n}\n```\n\n## 🧪 Testing Content Negotiation\n\nYou can test the content negotiation functionality using curl or any HTTP client:\n\n### Test Home Page Content Negotiation\n\n```bash\n# Request HTML (browser behavior)\ncurl -H \"Accept: text/html\" https://your-domain.com/\n\n# Request ActivityPub JSON (returns actor document)\ncurl -H \"Accept: application/activity+json\" https://your-domain.com/\n\n# Request JSON-LD (alternative ActivityPub format)\ncurl -H \"Accept: application/ld+json\" https://your-domain.com/\n\n# Mixed Accept header (browser with ActivityPub support) - prioritizes HTML\ncurl -H \"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,application/activity+json;q=0.8,*/*;q=0.7\" https://your-domain.com/\n\n# ActivityPub client request - prioritizes ActivityPub\ncurl -H \"Accept: application/activity+json, text/html;q=0.8\" https://your-domain.com/\n```\n\n### Test Actor Endpoint Content Negotiation\n\n```bash\n# Request HTML profile page\ncurl -H \"Accept: text/html\" https://your-domain.com/actor\n\n# Request ActivityPub actor document\ncurl -H \"Accept: application/activity+json\" https://your-domain.com/actor\n\n# Request JSON-LD actor document\ncurl -H \"Accept: application/ld+json\" https://your-domain.com/actor\n```\n\n### Expected Responses\n\n- **HTML requests**: Return human-readable web pages with proper styling\n- **ActivityPub requests**: Return JSON-LD documents with `Content-Type: application/activity+json`\n- **Link headers**: HTML responses include `Link` headers pointing to ActivityPub alternatives\n- **Smart prioritization**: When both content types are present, prioritizes based on order in Accept header\n- **Home page ActivityPub**: Returns the same actor document as `/actor` endpoint for consistency\n\n## 🚧 Current Status\n\n✅ **Fully Implemented Features:**\n1. **HTTP Signatures**: Cryptographic signatures for authentication ✅\n2. **Follow Processing**: The inbox processes Follow/Unfollow activities ✅\n3. **Push Notifications**: New posts are automatically pushed to followers ✅\n4. **Real Collections**: Followers/following collections contain real data ✅\n5. **Public Key Management**: Persistent RSA keys for signing ✅\n\n⚠️ **Setup Required:**\n- Generate RSA key pair for HTTP signatures (see setup instructions below)\n\n## 🛠️ HTTP Signatures Setup\n\nFor proper ActivityPub federation, you need to set up persistent RSA keys for HTTP signatures:\n\n### 1. Generate RSA Key Pair\n\nVisit your `/generate-keys.ts` val to generate a new RSA key pair. This will provide you with:\n- `ACTIVITYPUB_PUBLIC_KEY` - Public key in PEM format\n- `ACTIVITYPUB_PRIVATE_KEY` - Private key in PEM format\n\n### 2. Set Environment Variables\n\nAdd these to your Val Town environment variables:\n\n```bash\nACTIVITYPUB_PUBLIC_KEY=-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...\n-----END PUBLIC KEY-----\n\nACTIVITYPUB_PRIVATE_KEY=-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC...\n-----END PRIVATE KEY-----\n```\n\n### 3. Security Notes\n\n🔒 **IMPORTANT:**\n- Keep the private key secret and secure\n- Do not share the private key in public repositories\n- Once set, do not change these keys unless necessary\n- Changing keys will break federation with existing followers\n\n### 4. Verification\n\nAfter setting the keys:\n1. Restart your val\n2. Check the logs for \"✅ RSA key pair loaded from environment variables\"\n3. Test federation by following your blog from Mastodon\n\n## 🚧 Fallback Behavior\n\nIf no persistent keys are set, the system will:\n- Generate temporary keys on startup\n- Log a warning about using temporary keys\n- Still function, but keys will change on restart\n- May cause federation issues with some servers\n\n## 🧪 Testing\n\nUse the `/test-activitypub.ts` endpoint to verify all ActivityPub endpoints are working correctly.\n\n## 📚 References\n\n- [ActivityPub Specification](https://www.w3.org/TR/activitypub/)\n- [WebFinger Specification](https://tools.ietf.org/html/rfc7033)\n- [ActivityStreams Vocabulary](https://www.w3.org/TR/activitystreams-vocabulary/)\n- [Mastodon API Documentation](https://docs.joinmastodon.org/spec/activitypub/)\n\n---\n\nYour blog is now discoverable and followable from the fediverse! 🎉",[245],"a44938b2-69a3-11f0-aa22-0224a6c84d84","ACTIVITYPUB-TROUBLESHOOTING.md","0198439f-c37b-732a-a383-d86e0b814e57",["D",1753481200444],"# ActivityPub Troubleshooting Guide\n\n## Current Status: ⚠️ Partial Implementation\n\nYour ActivityPub implementation is **working correctly** but has one critical limitation that prevents posts from appearing in Mastodon timelines.\n\n## ✅ What's Working\n\n1. **ActivityPub Discovery**: Your blog is discoverable via WebFinger (`@blog@posthero.us`)\n2. **Following**: Users can follow your blog from Mastodon\n3. **Follower Management**: The system correctly tracks followers and their inboxes\n4. **Activity Creation**: Posts are converted to proper ActivityPub Create/Note activities\n5. **Delivery Attempts**: The system attempts to deliver activities to follower inboxes\n6. **Logging**: Comprehensive logging shows exactly what's happening\n\n## ❌ What's Not Working\n\n**HTTP Signatures**: Most Mastodon servers (including the one following you) require HTTP signatures for authentication. Your current implementation sends unsigned requests, which are rejected with:\n\n```\nHTTP 401: {\"error\":\"Request not signed\"}\n```\n\n## 🔍 Current Test Results\n\nFrom your latest test delivery:\n\n```\n📊 Followers found: {\n totalFollowers: 1,\n followersWithInbox: 1,\n followersWithSharedInbox: 1\n}\n\n📮 Delivery plan: { uniqueInboxes: 1, totalDeliveries: 1 }\n\n❌ Inbox delivery failed: {\n inbox: \"https://status.kinlan.me/inbox\",\n error: 'HTTP 401: {\"error\":\"Request not signed\"}',\n followers: [ \"paul\" ]\n}\n\n🎉 ACTIVITYPUB PUBLISH COMPLETED: {\n processingTimeMs: 395,\n totalInboxes: 1,\n successfulDeliveries: 0,\n failedDeliveries: 1,\n deliveryRate: \"0%\"\n}\n```\n\n## 🛠️ Solutions\n\n### Option 1: Implement HTTP Signatures (Recommended)\n\nHTTP signatures require:\n1. **RSA Key Pair**: Generate and store securely\n2. **Signature Creation**: Sign requests with private key\n3. **Public Key Distribution**: Serve public key in actor document\n\nThis is the proper long-term solution but requires careful cryptographic implementation.\n\n### Option 2: Find Mastodon Servers That Accept Unsigned Requests\n\nSome smaller Mastodon instances may accept unsigned requests for testing purposes.\n\n### Option 3: Use Alternative ActivityPub Servers\n\nSome ActivityPub implementations are more lenient with unsigned requests.\n\n## 🧪 Testing Your Implementation\n\nUse the test endpoint to verify delivery:\n\n```bash\n# Check current followers and posts\ncurl \"https://your-val.web.val.run/test-activitypub-delivery?action=info\"\n\n# Test delivery to current followers\ncurl \"https://your-val.web.val.run/test-activitypub-delivery?action=test-delivery\"\n```\n\n## 📝 Next Steps\n\n1. **Immediate**: Your ActivityPub setup is correct - the issue is authentication\n2. **Short-term**: Consider implementing HTTP signatures for full compatibility\n3. **Alternative**: Test with other ActivityPub servers that may be more lenient\n\n## 🔧 Implementation Notes\n\nThe current code includes:\n- ✅ Proper ActivityPub activity structure\n- ✅ Correct inbox discovery and delivery logic\n- ✅ SHA-256 digest creation for request bodies\n- ✅ Comprehensive error handling and logging\n- ❌ HTTP signature creation (disabled due to complexity)\n\n## 📚 Resources\n\n- [ActivityPub Specification](https://www.w3.org/TR/activitypub/)\n- [HTTP Signatures Specification](https://tools.ietf.org/html/draft-cavage-http-signatures)\n- [Mastodon ActivityPub Implementation](https://docs.joinmastodon.org/spec/activitypub/)\n\n---\n\n**Summary**: Your ActivityPub implementation is architecturally sound and would work perfectly with HTTP signatures. The 401 errors are expected behavior from security-conscious Mastodon servers.",[251],"a449347a-69a3-11f0-aa22-0224a6c84d84","ACTIVITYPUB-STATUS.md","0198439f-c37b-732a-a383-d492506ed244",["D",1753481200444],"# ActivityPub HTTP Signatures - Implementation Complete ✅\n\n## 🎉 Status: FULLY IMPLEMENTED AND WORKING\n\nYour ActivityPub HTTP signatures implementation is **complete and ready for production use**!\n\n## ✅ What's Working\n\n### 1. **HTTP Signatures** ✅\n- **RSA-SHA256 signatures** for all ActivityPub requests\n- **Persistent key management** using environment variables\n- **Proper signing string construction** with `(request-target)`, `host`, `date`, and `digest`\n- **Base64 signature encoding** following HTTP Signatures spec\n\n### 2. **Key Management** ✅\n- **Environment variable storage** for `ACTIVITYPUB_PUBLIC_KEY` and `ACTIVITYPUB_PRIVATE_KEY`\n- **Automatic key loading** on startup with fallback to temporary keys\n- **Key validation** and error handling\n- **PEM format support** for both public and private keys\n\n### 3. **ActivityPub Integration** ✅\n- **Actor document** includes real public key\n- **Outgoing requests** are properly signed\n- **Content negotiation** for ActivityPub endpoints\n- **Digest header** creation for POST requests\n\n### 4. **Federation Ready** ✅\n- **Mastodon compatibility** - signatures follow Mastodon's requirements\n- **Pleroma compatibility** - works with other ActivityPub implementations\n- **Persistent identity** - keys don't change on restart\n- **Production ready** - proper error handling and logging\n\n## 🔧 Current Configuration\n\nBased on the test results, your system has:\n\n- ✅ **ACTIVITYPUB_PUBLIC_KEY**: Set and valid (450 characters)\n- ✅ **ACTIVITYPUB_PRIVATE_KEY**: Set and valid\n- ✅ **HTTP Signatures**: Enabled and working\n- ✅ **Key Loading**: Successfully loading from environment variables\n- ✅ **Signature Creation**: Generating valid signatures with 344-character length\n\n## 🚀 How It Works\n\n### Request Signing Process\n\n1. **Create Signing String**:\n ```\n (request-target): post /inbox\n host: mastodon.social\n date: Fri, 11 Jul 2025 11:27:41 GMT\n digest: SHA-256=base64encodeddigest\n ```\n\n2. **Sign with RSA Private Key**:\n - Uses `RSASSA-PKCS1-v1_5` with `SHA-256`\n - Creates base64-encoded signature\n\n3. **Add Signature Header**:\n ```\n Signature: keyId=\"https://yourdomain.com/actor#main-key\",algorithm=\"rsa-sha256\",headers=\"(request-target) host date digest\",signature=\"base64signature\"\n ```\n\n### Key Discovery\n\nActivityPub servers can verify signatures by:\n1. Extracting `keyId` from signature header\n2. Fetching your actor document at `/actor`\n3. Using the `publicKey.publicKeyPem` field to verify the signature\n\n## 🧪 Testing Tools\n\nYou have several tools to verify everything is working:\n\n### 1. **HTTP Signatures Test** (`/test-http-signatures.ts`)\n- Tests key loading and signature creation\n- Validates environment variables\n- Shows detailed signature information\n\n### 2. **Key Generator** (`/generate-keys.ts`)\n- Generates new RSA key pairs\n- Provides copy-paste environment variables\n- Includes security instructions\n\n### 3. **ActivityPub Actor** (`/actor`)\n- Shows your actor document with real public key\n- Content negotiation for `application/activity+json`\n- Used by other servers for key verification\n\n## 📋 Signature Example\n\nHere's what your signatures look like:\n\n```http\nPOST /inbox HTTP/1.1\nHost: mastodon.social\nDate: Fri, 11 Jul 2025 11:27:41 GMT\nContent-Type: application/activity+json\nDigest: SHA-256=abc123...\nSignature: keyId=\"https://yourdomain.com/actor#main-key\",algorithm=\"rsa-sha256\",headers=\"(request-target) host date digest\",signature=\"VGhpcyBpcyBhIGJhc2U2NCBlbmNvZGVkIHNpZ25hdHVyZQ==\"\n\n{\n \"@context\": \"https://www.w3.org/ns/activitystreams\",\n \"type\": \"Create\",\n \"actor\": \"https://yourdomain.com/actor\",\n \"object\": {\n \"type\": \"Note\",\n \"content\": \"Your blog post content\"\n }\n}\n```\n\n## 🔒 Security Features\n\n- **RSA-2048 keys** for strong cryptographic security\n- **SHA-256 hashing** for digest and signature algorithms\n- **Persistent keys** prevent identity changes\n- **Environment variable storage** keeps private keys secure\n- **Proper key validation** prevents malformed keys\n\n## 🌐 Federation Compatibility\n\nYour implementation is compatible with:\n\n- ✅ **Mastodon** (most popular ActivityPub server)\n- ✅ **Pleroma** (lightweight ActivityPub server)\n- ✅ **Misskey** (Japanese ActivityPub server)\n- ✅ **PeerTube** (video sharing with ActivityPub)\n- ✅ **Pixelfed** (photo sharing with ActivityPub)\n- ✅ **Any ActivityPub server** that follows the HTTP Signatures spec\n\n## 🎯 Next Steps\n\nYour HTTP signatures are complete! Here's what you can do now:\n\n1. **Test Federation**: Follow your blog from a Mastodon account\n2. **Publish Posts**: Send emails to create posts that will be federated\n3. **Monitor Logs**: Watch for successful deliveries in your Val Town logs\n4. **Scale Up**: Your system is ready for production use\n\n## 📚 Technical References\n\n- [HTTP Signatures Specification](https://tools.ietf.org/html/draft-cavage-http-signatures)\n- [ActivityPub Specification](https://www.w3.org/TR/activitypub/)\n- [Mastodon HTTP Signatures Guide](https://docs.joinmastodon.org/spec/security/)\n\n---\n\n**🎉 Congratulations! Your ActivityPub HTTP signatures implementation is complete and production-ready!**",[257],"a4493380-69a3-11f0-aa22-0224a6c84d84",".vtignore","0198439f-c37b-732a-a383-d1e84e5f02f8",["D",1753481200444],".git\n.vscode\n.cursorrules\n.DS_Store\nnode_modules\nvendor",[263],"a4493268-69a3-11f0-aa22-0224a6c84d84","shared","0198439f-c37b-732a-a383-cc8ef4c02cbb",["D",1753481200444],"directory",[269],"a44928ae-69a3-11f0-aa22-0224a6c84d84","frontend","0198439f-c37b-732a-a383-c03ef45b4811",["D",1753481200444],[275],"a4490b12-69a3-11f0-aa22-0224a6c84d84","backend","0198439f-c37b-732a-a383-b45f9daf127d",["D",1753481200444],[280],"pulls","branches","forks","envVars",{"_291":293,"_294":293},"connections",{"_291":40,"_292":40},"count","unfilledCount",8,"emptyCount",{"_18":279,"_20":280,"_139":281,"_141":-5,"_142":66,"_143":64,"_144":36,"_22":534,"_63":40,"_146":272,"_148":-5,"_150":26,"_151":-5,"_338":535,"_85":536},{"_18":530,"_20":522,"_139":517,"_141":281,"_142":66,"_143":64,"_144":36,"_22":531,"_63":40,"_146":272,"_148":-5,"_150":26,"_151":-5,"_338":532,"_85":533},{"_18":523,"_20":524,"_139":525,"_141":517,"_142":66,"_143":64,"_144":36,"_22":526,"_63":40,"_146":175,"_148":527,"_150":26,"_151":-5,"_338":528,"_85":529},{"_18":514,"_20":515,"_139":516,"_141":517,"_142":66,"_143":64,"_144":36,"_22":518,"_63":40,"_146":175,"_148":519,"_150":26,"_151":-5,"_338":520,"_85":521},{"_18":510,"_20":446,"_139":441,"_141":281,"_142":66,"_143":64,"_144":36,"_22":511,"_63":40,"_146":272,"_148":-5,"_150":26,"_151":-5,"_338":512,"_85":513},{"_18":503,"_20":504,"_139":505,"_141":441,"_142":66,"_143":64,"_144":36,"_22":506,"_63":40,"_146":175,"_148":507,"_150":26,"_151":-5,"_338":508,"_85":509},{"_18":496,"_20":497,"_139":498,"_141":441,"_142":66,"_143":64,"_144":36,"_22":499,"_63":40,"_146":175,"_148":500,"_150":26,"_151":-5,"_338":501,"_85":502},{"_18":489,"_20":490,"_139":491,"_141":441,"_142":66,"_143":64,"_144":36,"_22":492,"_63":40,"_146":175,"_148":493,"_150":26,"_151":-5,"_338":494,"_85":495},{"_18":482,"_20":483,"_139":484,"_141":441,"_142":66,"_143":64,"_144":36,"_22":485,"_63":40,"_146":175,"_148":486,"_150":26,"_151":-5,"_338":487,"_85":488},{"_18":475,"_20":476,"_139":477,"_141":441,"_142":66,"_143":64,"_144":36,"_22":478,"_63":40,"_146":175,"_148":479,"_150":26,"_151":-5,"_338":480,"_85":481},{"_18":468,"_20":469,"_139":470,"_141":441,"_142":66,"_143":64,"_144":36,"_22":471,"_63":40,"_146":175,"_148":472,"_150":26,"_151":-5,"_338":473,"_85":474},{"_18":461,"_20":462,"_139":463,"_141":441,"_142":66,"_143":64,"_144":36,"_22":464,"_63":40,"_146":175,"_148":465,"_150":26,"_151":-5,"_338":466,"_85":467},{"_18":454,"_20":455,"_139":456,"_141":441,"_142":66,"_143":64,"_144":36,"_22":457,"_63":40,"_146":175,"_148":458,"_150":26,"_151":-5,"_338":459,"_85":460},{"_18":447,"_20":448,"_139":449,"_141":441,"_142":66,"_143":64,"_144":36,"_22":450,"_63":40,"_146":175,"_148":451,"_150":26,"_151":-5,"_338":452,"_85":453},{"_18":438,"_20":439,"_139":440,"_141":441,"_142":66,"_143":64,"_144":36,"_22":442,"_63":40,"_146":175,"_148":443,"_150":26,"_151":-5,"_338":444,"_85":445},{"_18":431,"_20":432,"_139":433,"_141":281,"_142":66,"_143":64,"_144":36,"_22":434,"_63":40,"_146":147,"_148":435,"_150":26,"_151":-5,"_338":436,"_85":437},{"_18":274,"_20":275,"_139":276,"_141":-5,"_142":66,"_143":64,"_144":36,"_22":428,"_63":40,"_146":272,"_148":-5,"_150":26,"_151":-5,"_338":429,"_85":430},{"_18":422,"_20":423,"_139":424,"_141":276,"_142":66,"_143":64,"_144":36,"_22":425,"_63":40,"_146":272,"_148":-5,"_150":26,"_151":-5,"_338":426,"_85":427},{"_18":415,"_20":416,"_139":417,"_141":276,"_142":66,"_143":64,"_144":36,"_22":418,"_63":40,"_146":95,"_148":419,"_150":26,"_151":-5,"_338":420,"_85":421},{"_18":268,"_20":269,"_139":270,"_141":-5,"_142":66,"_143":64,"_144":36,"_22":412,"_63":40,"_146":272,"_148":-5,"_150":26,"_151":-5,"_338":413,"_85":414},{"_18":405,"_20":406,"_139":407,"_141":270,"_142":66,"_143":64,"_144":36,"_22":408,"_63":40,"_146":175,"_148":409,"_150":26,"_151":-5,"_338":410,"_85":411},{"_18":398,"_20":399,"_139":400,"_141":270,"_142":66,"_143":64,"_144":36,"_22":401,"_63":40,"_146":175,"_148":402,"_150":26,"_151":-5,"_338":403,"_85":404},{"_18":262,"_20":263,"_139":264,"_141":-5,"_142":66,"_143":64,"_144":36,"_22":395,"_63":40,"_146":95,"_148":266,"_150":26,"_151":-5,"_338":396,"_85":397},{"_18":256,"_20":257,"_139":258,"_141":-5,"_142":66,"_143":64,"_144":36,"_22":392,"_63":40,"_146":95,"_148":260,"_150":26,"_151":-5,"_338":393,"_85":394},{"_18":250,"_20":251,"_139":252,"_141":-5,"_142":66,"_143":64,"_144":36,"_22":389,"_63":40,"_146":95,"_148":254,"_150":26,"_151":-5,"_338":390,"_85":391},{"_18":244,"_20":245,"_139":246,"_141":-5,"_142":66,"_143":64,"_144":36,"_22":386,"_63":40,"_146":95,"_148":248,"_150":26,"_151":-5,"_338":387,"_85":388},{"_18":238,"_20":239,"_139":240,"_141":-5,"_142":66,"_143":64,"_144":36,"_22":383,"_63":40,"_146":95,"_148":242,"_150":26,"_151":-5,"_338":384,"_85":385},{"_18":232,"_20":233,"_139":234,"_141":-5,"_142":66,"_143":64,"_144":36,"_22":380,"_63":40,"_146":95,"_148":236,"_150":26,"_151":-5,"_338":381,"_85":382},{"_18":226,"_20":227,"_139":228,"_141":-5,"_142":66,"_143":64,"_144":36,"_22":377,"_63":40,"_146":95,"_148":230,"_150":26,"_151":-5,"_338":378,"_85":379},{"_18":221,"_20":222,"_139":34,"_141":-5,"_142":66,"_143":64,"_144":36,"_22":374,"_63":40,"_146":147,"_148":224,"_150":26,"_151":-5,"_338":375,"_85":376},{"_18":215,"_20":216,"_139":217,"_141":-5,"_142":66,"_143":64,"_144":36,"_22":371,"_63":40,"_146":147,"_148":219,"_150":26,"_151":-5,"_338":372,"_85":373},{"_18":209,"_20":210,"_139":211,"_141":-5,"_142":66,"_143":64,"_144":36,"_22":368,"_63":40,"_146":95,"_148":213,"_150":26,"_151":-5,"_338":369,"_85":370},{"_18":202,"_20":203,"_139":204,"_141":-5,"_142":66,"_143":64,"_144":36,"_22":365,"_63":40,"_146":206,"_148":207,"_150":26,"_151":-5,"_338":366,"_85":367},{"_18":196,"_20":197,"_139":198,"_141":-5,"_142":66,"_143":64,"_144":36,"_22":362,"_63":40,"_146":147,"_148":200,"_150":26,"_151":-5,"_338":363,"_85":364},{"_18":190,"_20":191,"_139":192,"_141":-5,"_142":66,"_143":64,"_144":36,"_22":359,"_63":40,"_146":147,"_148":194,"_150":26,"_151":-5,"_338":360,"_85":361},{"_18":184,"_20":185,"_139":186,"_141":-5,"_142":66,"_143":64,"_144":36,"_22":356,"_63":40,"_146":147,"_148":188,"_150":26,"_151":-5,"_338":357,"_85":358},{"_18":178,"_20":179,"_139":180,"_141":-5,"_142":66,"_143":64,"_144":36,"_22":353,"_63":40,"_146":147,"_148":182,"_150":26,"_151":-5,"_338":354,"_85":355},{"_18":171,"_20":172,"_139":173,"_141":-5,"_142":66,"_143":64,"_144":36,"_22":350,"_63":40,"_146":175,"_148":176,"_150":26,"_151":-5,"_338":351,"_85":352},{"_18":165,"_20":166,"_139":167,"_141":-5,"_142":66,"_143":64,"_144":36,"_22":347,"_63":40,"_146":147,"_148":169,"_150":26,"_151":-5,"_338":348,"_85":349},{"_18":159,"_20":160,"_139":161,"_141":-5,"_142":66,"_143":64,"_144":36,"_22":344,"_63":40,"_146":147,"_148":163,"_150":26,"_151":-5,"_338":345,"_85":346},{"_18":153,"_20":154,"_139":155,"_141":-5,"_142":66,"_143":64,"_144":36,"_22":341,"_63":40,"_146":147,"_148":157,"_150":26,"_151":-5,"_338":342,"_85":343},{"_18":137,"_20":138,"_139":140,"_141":-5,"_142":66,"_143":64,"_144":36,"_22":337,"_63":40,"_146":147,"_148":149,"_150":26,"_151":-5,"_338":339,"_85":340},["D",1753481200444],"children",[],[138],["D",1753481200444],[],[154],["D",1753481200444],[],[160],["D",1753481200444],[],[166],["D",1753481200444],[],[172],["D",1753481200444],[],[179],["D",1753481200444],[],[185],["D",1753481200444],[],[191],["D",1753481200444],[],[197],["D",1753481200444],[],[203],["D",1753481200444],[],[210],["D",1753481200444],[],[216],["D",1753481200444],[],[222],["D",1753481200444],[],[227],["D",1753481200444],[],[233],["D",1753481200444],[],[239],["D",1753481200444],[],[245],["D",1753481200444],[],[251],["D",1753481200444],[],[257],["D",1753481200444],[],[263],"a4492bf6-69a3-11f0-aa22-0224a6c84d84","utils.ts","0198439f-c37b-732a-a383-cb4a7b6c88a1",["D",1753481200444],"// Shared utility functions\n\n/**\n * Create a URL-friendly slug from a title\n */\nexport function slugify(text: string): string {\n return text\n .toLowerCase()\n .trim()\n .replace(/[^\\w\\s-]/g, '') // Remove special characters\n .replace(/[\\s_-]+/g, '-') // Replace spaces and underscores with hyphens\n .replace(/^-+|-+$/g, ''); // Remove leading/trailing hyphens\n}\n\n/**\n * Extract author name from email address\n */\nexport function extractAuthorName(email: string): string {\n const localPart = email.split('@')[0];\n return localPart\n .replace(/[._-]/g, ' ')\n .replace(/\\b\\w/g, l => l.toUpperCase())\n .trim();\n}\n\n/**\n * Detect if content is HTML\n */\nexport function isHTML(content: string): boolean {\n const htmlRegex = /<[^>]*>/;\n return htmlRegex.test(content);\n}\n\n/**\n * Convert plain text to basic HTML\n */\nexport function textToHTML(text: string): string {\n return text\n .replace(/&/g, '&')\n .replace(//g, '>')\n .replace(/\\n\\n/g, '

')\n .replace(/\\n/g, '
')\n .replace(/^/, '

')\n .replace(/$/, '

');\n}\n\n/**\n * Decode HTML entities to their corresponding characters\n */\nexport function decodeHTMLEntities(text: string): string {\n // Common HTML entities mapping\n const entities: { [key: string]: string } = {\n '&': '&',\n '<': '<',\n '>': '>',\n '"': '\"',\n ''': \"'\",\n ''': \"'\",\n ''': \"'\",\n ' ': ' ',\n '©': '\\u00A9',\n '®': '\\u00AE',\n '™': '\\u2122',\n '…': '\\u2026',\n '—': '\\u2014',\n '–': '\\u2013',\n '‘': '\\u2018',\n '’': '\\u2019',\n '“': '\\u201C',\n '”': '\\u201D'\n };\n\n // Replace named entities\n let decoded = text;\n for (const [entity, char] of Object.entries(entities)) {\n decoded = decoded.replace(new RegExp(entity, 'g'), char);\n }\n\n // Replace numeric entities ({ and )\n decoded = decoded.replace(/&#(\\d+);/g, (match, num) => {\n return String.fromCharCode(parseInt(num, 10));\n });\n \n decoded = decoded.replace(/&#x([0-9a-fA-F]+);/g, (match, hex) => {\n return String.fromCharCode(parseInt(hex, 16));\n });\n\n return decoded;\n}\n\n/**\n * Truncate HTML content for descriptions\n */\nexport function truncateHTML(html: string, maxLength: number = 200): string {\n // Strip HTML tags for truncation measurement, but preserve spaces\n let text = html.replace(/<[^>]*>/g, ' ').replace(/\\s+/g, ' ').trim();\n \n // Decode HTML entities to get the actual text content\n text = decodeHTMLEntities(text);\n \n if (text.length <= maxLength) return text;\n \n return text.substring(0, maxLength).trim() + '...';\n}\n\n/**\n * Format date for RSS\n */\nexport function formatRSSDate(date: Date): string {\n return date.toUTCString();\n}\n\n/**\n * Format date for ActivityPub\n */\nexport function formatActivityPubDate(date: Date): string {\n return date.toISOString();\n}\n\n/**\n * Count graphemes (user-perceived characters) in a string\n * This is important for AT Protocol which has grapheme limits, not character limits\n */\nexport function countGraphemes(text: string): number {\n // Use Intl.Segmenter if available (modern browsers/Deno)\n if (typeof Intl !== 'undefined' && Intl.Segmenter) {\n const segmenter = new Intl.Segmenter('en', { granularity: 'grapheme' });\n return Array.from(segmenter.segment(text)).length;\n }\n \n // Fallback: approximate grapheme count\n // This handles most common cases but isn't perfect for all Unicode\n return Array.from(text).length;\n}\n\n/**\n * Truncate text to a specific grapheme count\n */\nexport function truncateToGraphemes(text: string, maxGraphemes: number): string {\n if (countGraphemes(text) <= maxGraphemes) {\n return text;\n }\n \n // Use Intl.Segmenter if available for precise truncation\n if (typeof Intl !== 'undefined' && Intl.Segmenter) {\n const segmenter = new Intl.Segmenter('en', { granularity: 'grapheme' });\n const segments = Array.from(segmenter.segment(text));\n \n if (segments.length <= maxGraphemes) {\n return text;\n }\n \n // Take maxGraphemes - 3 to leave room for \"...\"\n const truncateAt = Math.max(0, maxGraphemes - 3);\n const truncated = segments.slice(0, truncateAt).map(s => s.segment).join('');\n return truncated + '...';\n }\n \n // Fallback truncation\n const chars = Array.from(text);\n if (chars.length <= maxGraphemes) {\n return text;\n }\n \n const truncateAt = Math.max(0, maxGraphemes - 3);\n return chars.slice(0, truncateAt).join('') + '...';\n}\n\n/**\n * Create AT Protocol post content with proper grapheme limits\n */\nexport function createATProtoPostContent(title: string, content: string, postUrl: string, maxGraphemes: number = 300): string {\n const prefix = \"📝 New blog post: \";\n const suffix = `\\n\\nRead more: ${postUrl}`;\n \n // Calculate available space for title and content\n const fixedLength = countGraphemes(prefix) + countGraphemes(suffix);\n const availableForContent = maxGraphemes - fixedLength;\n \n if (availableForContent <= 0) {\n // If URL and prefix take up too much space, create minimal post\n const minimalPost = `📝 ${title}`;\n return truncateToGraphemes(minimalPost, maxGraphemes);\n }\n \n // Try to fit title + some content\n const titleWithPrefix = prefix + title;\n const titleLength = countGraphemes(titleWithPrefix);\n \n if (titleLength >= availableForContent) {\n // Title is too long, truncate it\n const maxTitleLength = availableForContent - 3; // Leave room for \"...\"\n const truncatedTitle = truncateToGraphemes(title, maxTitleLength);\n return truncateToGraphemes(prefix + truncatedTitle + suffix, maxGraphemes);\n }\n \n // Calculate space left for content preview\n const spaceForContent = availableForContent - titleLength - 2; // 2 for \"\\n\\n\"\n \n if (spaceForContent > 10) { // Only add content if we have reasonable space\n const contentPreview = truncateHTML(content, spaceForContent);\n const fullPost = `${titleWithPrefix}\\n\\n${contentPreview}${suffix}`;\n return truncateToGraphemes(fullPost, maxGraphemes);\n } else {\n // Not enough space for content, just title and URL\n const fullPost = `${titleWithPrefix}${suffix}`;\n return truncateToGraphemes(fullPost, maxGraphemes);\n }\n}\n\n/**\n * Check if we're running in development mode\n * Development mode is enabled when:\n * 1. NODE_ENV is set to 'development', OR\n * 2. DEV_MODE is set to 'true', OR\n * 3. ENABLE_TEST_ENDPOINTS is set to 'true'\n */\nexport function isDevelopmentMode(): boolean {\n // Check if we're in a browser environment (shared code)\n if (typeof Deno === 'undefined') {\n return false; // Default to production in browser\n }\n \n const nodeEnv = Deno.env.get('NODE_ENV')?.toLowerCase();\n const devMode = Deno.env.get('DEV_MODE')?.toLowerCase();\n const enableTests = Deno.env.get('ENABLE_TEST_ENDPOINTS')?.toLowerCase();\n \n return nodeEnv === 'development' || \n devMode === 'true' || \n enableTests === 'true';\n}\n\n/**\n * Create a development-only response wrapper\n * Returns 404 in production, executes handler in development\n */\nexport function devOnly(handler: () => T | Promise): T | Promise {\n if (!isDevelopmentMode()) {\n return new Response('Not Found', { \n status: 404,\n headers: { 'Content-Type': 'text/plain' }\n }) as any;\n }\n \n return handler();\n}",[],[269,399],"a4492a0c-69a3-11f0-aa22-0224a6c84d84","types.ts","0198439f-c37b-732a-a383-c613ed95f4e8",["D",1753481200444],"// Shared types for the blog platform\n\nexport interface BlogPost {\n id: number;\n title: string;\n slug: string;\n content: string;\n content_type: 'html' | 'text';\n author_email: string;\n author_name?: string;\n published_at: string;\n created_at: string;\n updated_at: string;\n}\n\nexport interface CreatePostData {\n title: string;\n slug: string;\n content: string;\n content_type: 'html' | 'text';\n author_email: string;\n author_name?: string;\n}\n\nexport interface DraftPost {\n id: number;\n title: string;\n slug: string;\n content: string;\n content_type: 'html' | 'text';\n author_email: string;\n author_name?: string;\n verification_token: string;\n expires_at: string;\n created_at: string;\n}\n\nexport interface CreateDraftPostData {\n title: string;\n slug: string;\n content: string;\n content_type: 'html' | 'text';\n author_email: string;\n author_name?: string;\n verification_token: string;\n expires_at: string;\n}\n\nexport interface EmailVerification {\n id: number;\n email: string;\n token: string;\n draft_post_id: number;\n expires_at: string;\n verified_at?: string;\n created_at: string;\n}\n\nexport interface RSSItem {\n title: string;\n link: string;\n description: string;\n pubDate: string;\n author: string;\n guid: string;\n}\n\nexport interface ActivityPubObject {\n '@context': string | string[];\n type: string;\n id: string;\n attributedTo: string;\n content: string;\n published: string;\n to: string[];\n cc?: string[];\n}\n\nexport interface ATProtoPost {\n text: string;\n createdAt: string;\n facets?: any[];\n embed?: any;\n}\n\nexport interface BlogImage {\n id: number;\n filename: string;\n original_filename: string;\n mime_type: string;\n file_size: number;\n width?: number;\n height?: number;\n alt_text?: string;\n post_slug?: string;\n uploaded_by_email: string;\n blob_key: string;\n created_at: string;\n}\n\nexport interface CreateImageData {\n filename: string;\n original_filename: string;\n mime_type: string;\n file_size: number;\n width?: number;\n height?: number;\n alt_text?: string;\n post_slug?: string;\n uploaded_by_email: string;\n blob_key: string;\n}\n\nexport interface EmailAttachment {\n filename: string;\n contentType: string;\n content: string; // base64 encoded\n size: number;\n}",[],[269,406],["D",1753481200444],[315,316],[269],"a4490d38-69a3-11f0-aa22-0224a6c84d84","upload.html","0198439f-c37b-732a-a383-bd428a0f5522",["D",1753481200444],"\n\n\n \n \n Upload Images - Posterous Blog\n \n \n\n\n

Upload Images

Upload images to use in your blog posts or as static assets.

\n ← Back to Blog\n

\n\n \n

\n Upload Password\n \n

Required to upload images (set via UPLOAD_PASSWORD environment variable)

\n\n

\n Your Email\n \n

For tracking who uploaded the image

\n\n

\n Post Slug (Optional)\n \n

Associate this image with a specific blog post

\n\n

\n Alt Text (Optional)\n \n

Helps with accessibility and SEO

\n\n \n

\n \n

Drop images here or click to select

Supports JPEG, PNG, GIF, WebP, SVG (max 5MB)

\n \n

\n\n \n

Uploading...

\n\n \n

✅ Upload Results

\n\n \n

📁 All Uploaded Images

\n \n

Enter your upload password above to view all uploaded images.

\n \n

\n\n \n

📋 Image URL Information

\n Uploaded images will be accessible at: /images/[unique-filename]\n

\n The system generates unique filenames like: 1704067200-abc123-my-image.jpg\n

Preview URLs for selected images:

\n\n \n

Selected Images

\n\n \n

📚 Quick Reference

\n \n

Using Images in Blog Posts

\n In HTML emails:\n <img src=\"/images/filename.jpg\" alt=\"Description\" />\n

\n In plain text emails:\n ![Description](/images/filename.jpg)\n

\n \n

Email Attachments

• Attach images to your blog post emails

• System automatically processes and stores them

• References like cid:image.jpg are auto-replaced

• Supports JPEG, PNG, GIF, WebP, SVG (max 5MB each)

\n \n

API Endpoints

\n GET /images/filename.jpg - Serve image\n

\n GET /api/posts/slug/images - Get post images\n

\n\n \n\n",[],[275,416],"a4490c34-69a3-11f0-aa22-0224a6c84d84","components","0198439f-c37b-732a-a383-b80994064a0b",["D",1753481200444],[],[275,423],["D",1753481200444],[312,313],[275],"a448de58-69a3-11f0-aa22-0224a6c84d84","index.ts","0198439f-c37b-732a-a383-b2d838218e77",["D",1753481200444],"import { Hono } from \"https://esm.sh/hono@3.11.7\";\nimport { readFile, serveFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport {\n deletePostsByAuthorName,\n getActiveFollowers,\n getAllImages,\n getAllPosts,\n getEmailVerificationByToken,\n getFollowerCount,\n getImagesByPostSlug,\n getImagesByUser,\n getPostActivityCounts,\n getPostBySlug,\n getRecentPosts,\n markEmailVerified,\n publishDraftPost,\n} from \"./database/queries.ts\";\nimport { initializeDatabase } from \"./database/schema.ts\";\nimport { processInboxActivity } from \"./services/activitypub-inbox.ts\";\nimport { generateActorDocument } from \"./services/activitypub.ts\";\nimport { publishToActivityPub } from \"./services/activitypub.ts\";\nimport { publishToATProtocol } from \"./services/atprotocol.ts\";\nimport { isUploadEnabled, validateUploadPassword } from \"./services/auth.ts\";\nimport { isEmailAllowed } from \"./services/email-security.ts\";\nimport {\n deleteImageCompletely,\n getImageData,\n getImageUrl,\n storeImageFromFile,\n validateImageFile,\n} from \"./services/images.ts\";\nimport { generateRSSFeed } from \"./services/rss.ts\";\nimport { extractDomain, generateWebFingerResponse, isValidWebFingerResource } from \"./services/webfinger.ts\";\nimport { handleWebSubSubscription } from \"./services/websub.ts\";\nimport { notifyWebSubSubscribers } from \"./services/websub.ts\";\n\nconst app = new Hono();\n\n// Unwrap Hono errors to see original error details\napp.onError((err, c) => {\n throw err;\n});\n\n// Initialize database lazily on first request to avoid startup memory issues\nlet dbInitialized = false;\nasync function ensureDbInitialized() {\n if (!dbInitialized) {\n await initializeDatabase();\n dbInitialized = true;\n }\n}\n\n// Get base URL for the application\nfunction getBaseUrl(c: any): string {\n // Prioritize BASE_URL environment variable for custom domains\n const baseUrl = Deno.env.get(\"BASE_URL\");\n if (baseUrl) {\n // Ensure the BASE_URL has a protocol\n if (baseUrl.startsWith(\"http://\") || baseUrl.startsWith(\"https://\")) {\n return baseUrl.replace(/\\/$/, \"\"); // Remove trailing slash if present\n } else {\n // Assume https if no protocol is specified\n return `https://${baseUrl}`;\n }\n }\n\n // Fall back to request headers\n const host = c.req.header(\"host\") || \"localhost:3000\";\n const protocol = c.req.header(\"x-forwarded-proto\") || \"https\";\n return `${protocol}://${host}`;\n}\n\n// Format date for display\nfunction formatDate(dateString: string): string {\n const date = new Date(dateString);\n return date.toLocaleDateString(\"en-US\", {\n year: \"numeric\",\n month: \"long\",\n day: \"numeric\",\n hour: \"2-digit\",\n minute: \"2-digit\",\n });\n}\n\n// Truncate content for previews\nfunction truncateContent(content: string, maxLength: number = 300): string {\n const text = content.replace(/<[^>]*>/g, \"\");\n if (text.length <= maxLength) return text;\n return text.substring(0, maxLength).trim() + \"...\";\n}\n\n// Generate verification success HTML\nfunction generateVerificationSuccessHTML(message: string, alreadyPublished: boolean = false, postUrl?: string): string {\n return `\n\n\n \n \n Email Verified - Email Blog\n \n \n\n\n

\n ${alreadyPublished ? \"📝\" : \"✅\"}\n

\n ${alreadyPublished ? \"Already Published\" : \"Email Verified!\"}\n

${escapeHtml(message)}

\n ${\n postUrl\n ? `\n \n View Your Post\n \n `\n : \"\"\n }\n \n ← Back to Blog\n \n

\n\n`;\n}\n\n// Generate verification error HTML\nfunction generateVerificationErrorHTML(message: string): string {\n return `\n\n\n \n \n Verification Error - Email Blog\n \n \n\n\n

\n ❌\n

Verification Failed

${escapeHtml(message)}

\n If you believe this is an error, please try sending your email again.\n

\n \n ← Back to Blog\n \n

\n\n`;\n}\n\n// Generate main blog HTML\nfunction generateBlogHTML(posts: any[], baseUrl: string): string {\n const postsHTML = posts.length === 0\n ? `

\n ✉️\n

No posts yet

Send an email to start publishing!

`\n : posts.map(post => `\n

\n \n ${escapeHtml(post.title)}\n \n

\n By ${escapeHtml(post.author_name || post.author_email)}\n ${formatDate(post.published_at)}\n

${truncateContent(post.content)}

\n \n Read more →\n \n

\n ${post.content_type === \"html\" ? \"🌐 HTML\" : \"📝 Text\"}\n

\n `).join(\"\");\n\n return `\n\n\n \n \n Email Blog\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n 📧\">\n \n \n \n \n\n\n \n

\n 📧\n

Email Blog

Want your own email blog? Fork this.

\n \n

\n\n \n

\n ${postsHTML}\n

\n\n \n \n\n`;\n}\n\n// Generate individual post HTML\nfunction generatePostHTML(\n post: any,\n baseUrl: string,\n activityCounts?: { likes: number; shares: number; replies: number },\n): string {\n const postUrl = `${baseUrl}/post/${post.slug}`;\n const description = post.content.replace(/<[^>]*>/g, \"\").substring(0, 160);\n\n return `\n\n\n \n \n ${escapeHtml(post.title)} - Email Blog\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n 📧\">\n \n \n \n \n\n\n \n

\n \n 📧\n

Email Blog

← Back to all posts

\n \n \n

\n\n \n

\n \n

${escapeHtml(post.title)}

\n 👤\n ${escapeHtml(post.author_name || post.author_email)}\n

\n 📅\n ${formatDate(post.published_at)}\n

\n ${post.content_type === \"html\" ? \"🌐 HTML\" : \"📝 Text\"}\n

\n\n \n

\n ${post.content}\n

\n\n \n \n

\n\n \n \n\n \n\n`;\n}\n\n// Generate 404 HTML\nfunction generate404HTML(): string {\n return `\n\n\n \n \n Post Not Found - Email Blog\n \n \n\n\n

\n ❌\n

Post Not Found

The requested post could not be found.

\n ← Back to Blog\n

\n\n`;\n}\n\n// Escape HTML to prevent XSS\nfunction escapeHtml(text: string): string {\n const map: { [key: string]: string } = {\n \"&\": \"&\",\n \"<\": \"<\",\n \">\": \">\",\n \"\\\"\": \""\",\n \"'\": \"'\",\n };\n return text.replace(/[&<>\"']/g, (m) => map[m]);\n}\n\n// Get custom CSS\nfunction getCustomCSS(): string {\n return `\n /* Typography */\n .prose {\n max-width: none;\n }\n .prose h1 { @apply text-3xl font-bold text-gray-900 mb-4; }\n .prose h2 { @apply text-2xl font-semibold text-gray-800 mb-3 mt-6; }\n .prose h3 { @apply text-xl font-medium text-gray-700 mb-2 mt-4; }\n .prose p { @apply text-gray-600 mb-4 leading-relaxed; }\n .prose a { @apply text-blue-600 hover:text-blue-800 underline; }\n .prose ul, .prose ol { @apply mb-4 pl-6; }\n .prose li { @apply mb-1; }\n .prose blockquote { @apply border-l-4 border-gray-300 pl-4 italic text-gray-600 my-4; }\n .prose code { @apply bg-gray-100 px-1 py-0.5 rounded text-sm font-mono; }\n .prose pre { @apply bg-gray-100 p-4 rounded overflow-x-auto mb-4; }\n .prose pre code { @apply bg-transparent p-0; }\n\n /* Blog post styling */\n .blog-post-content { @apply prose max-w-none; }\n .blog-post-content img { @apply max-w-full h-auto rounded-lg shadow-sm my-4; }\n .blog-post-content a { color: blue; }\n\n /* Post cards */\n .post-card { @apply bg-white rounded-lg shadow-sm border border-gray-200 hover:shadow-md transition-shadow duration-200; }\n .post-card:hover { @apply border-gray-300; }\n\n /* Email icon animation */\n .email-icon { animation: bounce 2s infinite; }\n @keyframes bounce {\n 0%, 20%, 53%, 80%, 100% { transform: translateY(0); }\n 40%, 43% { transform: translateY(-10px); }\n 70% { transform: translateY(-5px); }\n 90% { transform: translateY(-2px); }\n }\n\n /* Social links */\n .social-links a { @apply inline-flex items-center px-3 py-2 text-sm font-medium text-gray-600 hover:text-gray-900 hover:bg-gray-100 rounded-md transition-colors duration-200; }\n\n /* Responsive adjustments */\n @media (max-width: 640px) {\n .prose h1 { @apply text-2xl; }\n .prose h2 { @apply text-xl; }\n .prose h3 { @apply text-lg; }\n }\n `;\n}\n\n// Serve static files\napp.get(\"/frontend/*\", c => serveFile(c.req.path, import.meta.url));\napp.get(\"/shared/*\", c => serveFile(c.req.path, import.meta.url));\n\n// Main blog page with content negotiation\napp.get(\"/\", async c => {\n try {\n await ensureDbInitialized();\n const baseUrl = getBaseUrl(c);\n\n // Check if this is an ActivityPub request (using same logic as actor endpoint)\n const acceptHeader = c.req.header(\"accept\") || \"\";\n const isBrowserRequest = acceptHeader.includes(\"text/html\")\n && (!acceptHeader.includes(\"application/activity+json\")\n || acceptHeader.indexOf(\"text/html\") < acceptHeader.indexOf(\"application/activity+json\"))\n && (!acceptHeader.includes(\"application/ld+json\")\n || acceptHeader.indexOf(\"text/html\") < acceptHeader.indexOf(\"application/ld+json\"));\n\n const isActivityPubRequest = !isBrowserRequest && (\n acceptHeader.includes(\"application/activity+json\")\n || acceptHeader.includes(\"application/ld+json\")\n );\n\n if (isActivityPubRequest) {\n // Return ActivityPub actor document for the home page\n const domain = new URL(baseUrl).hostname;\n const actor = await generateActorDocument(domain);\n return c.json(actor, 200, {\n \"Content-Type\": \"application/activity+json\",\n });\n }\n\n // Return HTML for regular requests\n const posts = await getAllPosts(20);\n const html = generateBlogHTML(posts, baseUrl);\n\n // Add Link headers for ActivityPub discovery\n return c.html(html, 200, {\n \"Link\": `<${baseUrl}/actor>; rel=\"alternate\"; type=\"application/activity+json\"`,\n });\n } catch (error) {\n console.error(\"Error serving main page:\", error);\n return c.text(\"Error loading blog\", 500);\n }\n});\n\n// Individual post page\napp.get(\"/post/:slug\", async c => {\n try {\n await ensureDbInitialized();\n const slug = c.req.param(\"slug\");\n const post = await getPostBySlug(slug);\n\n if (!post) {\n return c.html(generate404HTML(), 404);\n }\n\n // Check if this is an ActivityPub request\n const acceptHeader = c.req.header(\"accept\") || \"\";\n const isActivityPubRequest = acceptHeader.includes(\"application/activity+json\")\n || acceptHeader.includes(\"application/ld+json\");\n\n if (isActivityPubRequest) {\n // Return ActivityPub Note object\n const baseUrl = getBaseUrl(c);\n const contentHtml = post.content_type === \"html\"\n ? post.content\n : `

${post.content.replace(/\\n/g, \"
\")}

`;\n\n const textContent = post.content.replace(/<[^>]*>/g, \"\");\n const summary = textContent.length > 200\n ? textContent.substring(0, 200) + \"...\"\n : textContent;\n\n const note = {\n \"@context\": \"https://www.w3.org/ns/activitystreams\",\n type: \"Note\",\n id: `${baseUrl}/post/${post.slug}`,\n attributedTo: `${baseUrl}/actor`,\n published: new Date(post.published_at).toISOString(),\n url: `${baseUrl}/post/${post.slug}`,\n to: [\"https://www.w3.org/ns/activitystreams#Public\"],\n cc: [`${baseUrl}/followers`],\n name: post.title,\n summary: summary,\n content: `

${post.title}

${contentHtml}`,\n source: {\n content: post.content,\n mediaType: post.content_type === \"html\" ? \"text/html\" : \"text/plain\",\n },\n tag: [],\n attachment: [],\n sensitive: false,\n // Add replies collection\n replies: {\n type: \"Collection\",\n id: `${baseUrl}/post/${post.slug}/replies`,\n totalItems: 0,\n items: [],\n },\n };\n\n return c.json(note, 200, {\n \"Content-Type\": \"application/activity+json\",\n });\n }\n\n // Return HTML for regular requests\n // Get activity counts for this post\n const activityCounts = await getPostActivityCounts(slug);\n\n const baseUrl = getBaseUrl(c);\n const html = generatePostHTML(post, baseUrl, activityCounts);\n\n // Add Link header for ActivityPub discovery\n return c.html(html, 200, {\n \"Link\": `<${baseUrl}/post/${slug}>; rel=\"alternate\"; type=\"application/activity+json\"`,\n });\n } catch (error) {\n console.error(\"Error serving post:\", error);\n return c.text(\"Error loading post\", 500);\n }\n});\n\n// RSS feed\napp.get(\"/rss\", async c => {\n try {\n await ensureDbInitialized();\n const posts = await getRecentPosts(50);\n const baseUrl = getBaseUrl(c);\n const rssXML = generateRSSFeed(posts, baseUrl);\n\n return c.text(rssXML, 200, {\n \"Content-Type\": \"application/rss+xml; charset=utf-8\",\n \"Cache-Control\": \"public, max-age=3600\",\n });\n } catch (error) {\n console.error(\"Error generating RSS feed:\", error);\n return c.text(\"Error generating RSS feed\", 500);\n }\n});\n\n// API: Get all posts\napp.get(\"/api/posts\", async c => {\n try {\n await ensureDbInitialized();\n const limit = parseInt(c.req.query(\"limit\") || \"20\");\n const offset = parseInt(c.req.query(\"offset\") || \"0\");\n const posts = await getAllPosts(limit, offset);\n\n return c.json({ posts });\n } catch (error) {\n console.error(\"Error fetching posts:\", error);\n return c.json({ error: \"Failed to fetch posts\" }, 500);\n }\n});\n\n// API: Get single post\napp.get(\"/api/posts/:slug\", async c => {\n try {\n await ensureDbInitialized();\n const slug = c.req.param(\"slug\");\n const post = await getPostBySlug(slug);\n\n if (!post) {\n return c.json({ error: \"Post not found\" }, 404);\n }\n\n // Get activity counts\n const activityCounts = await getPostActivityCounts(slug);\n\n return c.json({ post, activityCounts });\n } catch (error) {\n console.error(\"Error fetching post:\", error);\n return c.json({ error: \"Failed to fetch post\" }, 500);\n }\n});\n\n// // API: Delete posts by author name (for cleanup)\n// app.delete(\"/api/posts/author/:authorName\", async c => {\n// try {\n// await ensureDbInitialized();\n// const authorName = c.req.param(\"authorName\");\n\n// if (!authorName) {\n// return c.json({ error: \"Author name is required\" }, 400);\n// }\n\n// console.log(`🗑️ Request to delete posts by author: ${authorName}`);\n\n// const deletedCount = await deletePostsByAuthorName(authorName);\n\n// return c.json({\n// message: `Successfully deleted ${deletedCount} posts by ${authorName}`,\n// deletedCount\n// });\n// } catch (error) {\n// console.error(\"Error deleting posts:\", error);\n// return c.json({ error: \"Failed to delete posts\" }, 500);\n// }\n// });\n\n// Human-readable followers page\napp.get(\"/followers-list\", async c => {\n try {\n await ensureDbInitialized();\n const followers = await getActiveFollowers();\n const followerCount = await getFollowerCount();\n const baseUrl = getBaseUrl(c);\n\n const html = `\n\n\n \n \n Followers - Email Blog\n \n \n\n\n

Followers

\n \n ${followerCount} follower${followerCount !== 1 ? \"s\" : \"\"}\n \n

\n \n ${\n followers.length === 0\n ? `\n

\n 👥\n

No followers yet

Share your blog to get your first followers!

\n People can follow @blog@${\n new URL(baseUrl).hostname\n } from Mastodon\n

\n `\n : `\n

\n ${\n followers.map(follower => `\n

\n ${\n follower.actor_icon_url\n ? `\n $\"${\n$ \n `\n : `\n

\n ${(follower.actor_display_name || follower.actor_username || \"U\")[0].toUpperCase()}\n

\n `\n }\n

\n ${\n escapeHtml(follower.actor_display_name || follower.actor_username || \"Unknown User\")\n }\n

\n ${\n follower.actor_username\n ? `\n @${\n escapeHtml(follower.actor_username)\n }\n `\n : \"\"\n }\n

\n ${\n follower.actor_domain\n ? `\n 📍 ${escapeHtml(follower.actor_domain)}\n `\n : \"\"\n }\n 📅 Followed ${formatDate(follower.followed_at)}\n

\n \n View Profile →\n \n

\n `).join(\"\")\n }\n

\n `\n }\n \n

\n \n ← Back to Blog\n \n

\n JSON API\n •\n ActivityPub\n

\n\n`;\n\n return c.html(html);\n } catch (error) {\n console.error(\"Error serving followers page:\", error);\n return c.text(\"Error loading followers\", 500);\n }\n});\n\n// API: Get followers list (human-readable)\napp.get(\"/api/followers\", async c => {\n try {\n await ensureDbInitialized();\n const followers = await getActiveFollowers();\n const followerCount = await getFollowerCount();\n\n return c.json({\n totalFollowers: followerCount,\n followers: followers.map(follower => ({\n actorId: follower.actor_id,\n username: follower.actor_username,\n displayName: follower.actor_display_name,\n domain: follower.actor_domain,\n iconUrl: follower.actor_icon_url,\n followedAt: follower.followed_at,\n lastActivityAt: follower.last_activity_at,\n isActive: follower.is_active === 1,\n })),\n });\n } catch (error) {\n console.error(\"Error fetching followers:\", error);\n return c.json({ error: \"Failed to fetch followers\" }, 500);\n }\n});\n\n// API: Get activity counts for a post\napp.get(\"/api/posts/:slug/activities\", async c => {\n try {\n await ensureDbInitialized();\n const slug = c.req.param(\"slug\");\n const post = await getPostBySlug(slug);\n\n if (!post) {\n return c.json({ error: \"Post not found\" }, 404);\n }\n\n const activityCounts = await getPostActivityCounts(slug);\n return c.json({ activityCounts });\n } catch (error) {\n console.error(\"Error fetching activity counts:\", error);\n return c.json({ error: \"Failed to fetch activity counts\" }, 500);\n }\n});\n\n// WebSub hub endpoint\napp.get(\"/websub\", async c => {\n try {\n await ensureDbInitialized();\n const mode = c.req.query(\"hub.mode\");\n const callback = c.req.query(\"hub.callback\");\n const topic = c.req.query(\"hub.topic\");\n const challenge = c.req.query(\"hub.challenge\");\n const leaseSeconds = c.req.query(\"hub.lease_seconds\");\n const secret = c.req.query(\"hub.secret\");\n\n if (!mode || !callback || !topic) {\n return c.text(\"Missing required parameters\", 400);\n }\n\n const result = await handleWebSubSubscription(\n mode,\n callback,\n topic,\n challenge,\n leaseSeconds ? parseInt(leaseSeconds) : undefined,\n secret,\n );\n\n if (result) {\n return c.text(result);\n }\n\n return c.text(\"OK\", 200);\n } catch (error) {\n console.error(\"WebSub error:\", error);\n return c.text(\"WebSub error\", 400);\n }\n});\n\n// ActivityPub actor endpoint with content negotiation\napp.get(\"/actor\", async c => {\n const startTime = Date.now();\n console.log(\"🎭 === ACTOR ENDPOINT START ===\");\n\n try {\n const baseUrl = getBaseUrl(c);\n const domain = new URL(baseUrl).hostname;\n\n // Log request details\n const acceptHeader = c.req.header(\"accept\") || \"\";\n const userAgent = c.req.header(\"user-agent\") || \"\";\n const referer = c.req.header(\"referer\") || \"\";\n\n console.log(\"📥 Actor request details:\", {\n baseUrl,\n domain,\n acceptHeader,\n userAgent: userAgent.substring(0, 100) + (userAgent.length > 100 ? \"...\" : \"\"),\n referer,\n method: c.req.method,\n url: c.req.url,\n headers: Object.fromEntries(\n Object.entries(c.req.header()).filter(([key]) =>\n [\"accept\", \"user-agent\", \"authorization\", \"content-type\", \"host\"].includes(key.toLowerCase())\n ),\n ),\n });\n\n // Check if this is a browser request (HTML)\n const isBrowserRequest = acceptHeader.includes(\"text/html\")\n && (!acceptHeader.includes(\"application/activity+json\")\n || acceptHeader.indexOf(\"text/html\") < acceptHeader.indexOf(\"application/activity+json\"))\n && (!acceptHeader.includes(\"application/ld+json\")\n || acceptHeader.indexOf(\"text/html\") < acceptHeader.indexOf(\"application/ld+json\"));\n\n console.log(\"🔍 Content negotiation:\", {\n acceptHeader,\n isBrowserRequest,\n isActivityPubRequest: !isBrowserRequest,\n htmlIndex: acceptHeader.indexOf(\"text/html\"),\n activityJsonIndex: acceptHeader.indexOf(\"application/activity+json\"),\n ldJsonIndex: acceptHeader.indexOf(\"application/ld+json\"),\n });\n\n if (isBrowserRequest) {\n console.log(\"🌐 Serving HTML response for browser\");\n // Return HTML page for browsers\n const html = `\n\n\n \n \n ActivityPub Actor - Email Blog\n \n \n\n\n

\n 📧\n

Email Blog

ActivityPub Actor Profile

\n \n

About

A blog powered by email publishing. Follow for updates on new posts!

\n \n

Follow from Mastodon

You can follow this blog from any ActivityPub-compatible platform like Mastodon:

\n @blog@${domain}\n

\n \n

ActivityPub Endpoints

Actor: ${baseUrl}/actor

Inbox: ${baseUrl}/inbox

Outbox: ${baseUrl}/outbox

Followers: ${baseUrl}/followers

\n \n

\n \n ← Back to Blog\n \n

\n View Followers\n •\n RSS Feed\n

\n\n`;\n\n const processingTime = Date.now() - startTime;\n console.log(\"✅ HTML response sent\", {\n processingTimeMs: processingTime,\n responseSize: html.length,\n });\n\n return c.html(html, 200, {\n \"Link\": `<${baseUrl}/actor>; rel=\"alternate\"; type=\"application/activity+json\"`,\n });\n }\n\n // Return ActivityPub JSON for ActivityPub clients\n console.log(\"🔗 Generating ActivityPub actor document...\");\n const actor = await generateActorDocument(domain);\n\n console.log(\"📄 Actor document generated:\", {\n id: actor.id,\n type: actor.type,\n preferredUsername: actor.preferredUsername,\n name: actor.name,\n inbox: actor.inbox,\n outbox: actor.outbox,\n followers: actor.followers,\n following: actor.following,\n publicKeyId: actor.publicKey?.id,\n endpoints: actor.endpoints,\n });\n\n const processingTime = Date.now() - startTime;\n console.log(\"✅ ActivityPub JSON response sent\", {\n processingTimeMs: processingTime,\n actorId: actor.id,\n });\n\n return c.json(actor, 200, {\n \"Content-Type\": \"application/activity+json\",\n });\n } catch (error) {\n const processingTime = Date.now() - startTime;\n console.error(\"💥 ActivityPub actor error:\", {\n error: error.message,\n stack: error.stack,\n processingTimeMs: processingTime,\n });\n return c.json({ error: \"Failed to generate actor document\" }, 500);\n } finally {\n console.log(\"🎭 === ACTOR ENDPOINT END ===\");\n }\n});\n\n// ActivityPub inbox (for receiving activities)\napp.post(\"/inbox\", async c => {\n try {\n await ensureDbInitialized();\n const activity = await c.req.json();\n const baseUrl = getBaseUrl(c);\n const domain = new URL(baseUrl).hostname;\n\n console.log(\"Received ActivityPub activity:\", {\n id: activity.id,\n type: activity.type,\n actor: typeof activity.actor === \"string\" ? activity.actor : activity.actor?.id,\n });\n\n // Process the activity\n const result = await processInboxActivity(activity, domain);\n\n if (result.success) {\n console.log(\"Activity processed successfully:\", result.message);\n return c.text(\"\", 202);\n } else {\n console.error(\"Activity processing failed:\", result.message);\n return c.text(\"Error processing activity\", 400);\n }\n } catch (error) {\n console.error(\"ActivityPub inbox error:\", error);\n return c.text(\"Error processing activity\", 400);\n }\n});\n\n// ActivityPub outbox (for serving activities)\napp.get(\"/outbox\", async c => {\n try {\n await ensureDbInitialized();\n const baseUrl = getBaseUrl(c);\n\n // Support pagination parameters\n const page = parseInt(c.req.query(\"page\") || \"0\");\n const limit = 20;\n\n // Get recent posts to create activities\n const posts = await getRecentPosts(50); // Get more posts for pagination\n const totalItems = posts.length;\n\n // If no page parameter is provided, return the collection summary\n if (!c.req.query(\"page\")) {\n const outbox = {\n \"@context\": \"https://www.w3.org/ns/activitystreams\",\n type: \"OrderedCollection\",\n id: `${baseUrl}/outbox`,\n totalItems: totalItems,\n first: totalItems > 0 ? `${baseUrl}/outbox?page=1` : undefined,\n last: totalItems > 0 ? `${baseUrl}/outbox?page=${Math.ceil(totalItems / limit)}` : undefined,\n };\n\n return c.json(outbox, 200, {\n \"Content-Type\": \"application/activity+json\",\n });\n }\n\n // Return paginated results\n const offset = (page - 1) * limit;\n const paginatedPosts = posts.slice(offset, offset + limit);\n const hasNext = offset + limit < posts.length;\n const hasPrev = page > 1;\n\n const activities = paginatedPosts.map(post => {\n // Create better content for ActivityPub\n const contentHtml = post.content_type === \"html\"\n ? post.content\n : `

${post.content.replace(/\\n/g, \"
\")}

`;\n\n // Create a proper summary/preview\n const textContent = post.content.replace(/<[^>]*>/g, \"\");\n const summary = textContent.length > 200\n ? textContent.substring(0, 200) + \"...\"\n : textContent;\n\n return {\n type: \"Create\",\n id: `${baseUrl}/post/${post.slug}#create`,\n actor: `${baseUrl}/actor`,\n published: new Date(post.published_at).toISOString(),\n to: [\"https://www.w3.org/ns/activitystreams#Public\"],\n cc: [`${baseUrl}/followers`],\n object: {\n type: \"Note\",\n id: `${baseUrl}/post/${post.slug}`,\n attributedTo: `${baseUrl}/actor`,\n published: new Date(post.published_at).toISOString(),\n url: `${baseUrl}/post/${post.slug}`,\n to: [\"https://www.w3.org/ns/activitystreams#Public\"],\n cc: [`${baseUrl}/followers`],\n // Use the post title as the summary/name\n name: post.title,\n summary: summary,\n // Full content with proper HTML\n content: `

${post.title}

${contentHtml}`,\n // Add source for better compatibility\n source: {\n content: post.content,\n mediaType: post.content_type === \"html\" ? \"text/html\" : \"text/plain\",\n },\n // Add tags for better discoverability\n tag: [],\n // Add attachment info if needed\n attachment: [],\n // Indicate this is sensitive content if needed\n sensitive: false,\n },\n };\n });\n\n const outboxPage = {\n \"@context\": \"https://www.w3.org/ns/activitystreams\",\n type: \"OrderedCollectionPage\",\n id: `${baseUrl}/outbox?page=${page}`,\n partOf: `${baseUrl}/outbox`,\n totalItems: totalItems,\n next: hasNext ? `${baseUrl}/outbox?page=${page + 1}` : undefined,\n prev: hasPrev ? `${baseUrl}/outbox?page=${page - 1}` : undefined,\n orderedItems: activities,\n };\n\n return c.json(outboxPage, 200, {\n \"Content-Type\": \"application/activity+json\",\n });\n } catch (error) {\n console.error(\"ActivityPub outbox error:\", error);\n return c.json({ error: \"Failed to generate outbox\" }, 500);\n }\n});\n\n// ActivityPub followers collection\napp.get(\"/followers\", async c => {\n try {\n await ensureDbInitialized();\n const baseUrl = getBaseUrl(c);\n\n // Support pagination parameters\n const page = parseInt(c.req.query(\"page\") || \"1\");\n const limit = parseInt(c.req.query(\"limit\") || \"20\");\n const offset = (page - 1) * limit;\n\n const followers = await getActiveFollowers();\n const followerCount = await getFollowerCount();\n\n // If no page parameter is provided, return the collection summary\n if (!c.req.query(\"page\")) {\n const followersCollection = {\n \"@context\": \"https://www.w3.org/ns/activitystreams\",\n type: \"OrderedCollection\",\n id: `${baseUrl}/followers`,\n totalItems: followerCount,\n first: followerCount > 0 ? `${baseUrl}/followers?page=1` : undefined,\n // Include a sample of followers in the main collection\n orderedItems: followers.slice(0, Math.min(20, followers.length)).map(follower => ({\n id: follower.actor_id,\n type: \"Person\",\n preferredUsername: follower.actor_username || \"unknown\",\n name: follower.actor_display_name || follower.actor_username || \"Unknown User\",\n icon: follower.actor_icon_url\n ? {\n type: \"Image\",\n url: follower.actor_icon_url,\n }\n : undefined,\n url: follower.actor_id,\n // Include domain info for display\n summary: follower.actor_domain ? `User from ${follower.actor_domain}` : undefined,\n // Include follow date\n published: follower.followed_at,\n })),\n };\n\n return c.json(followersCollection, 200, {\n \"Content-Type\": \"application/activity+json\",\n });\n }\n\n // Return paginated results\n const paginatedFollowers = followers.slice(offset, offset + limit);\n const hasNext = offset + limit < followers.length;\n const hasPrev = page > 1;\n\n const followersPage = {\n \"@context\": \"https://www.w3.org/ns/activitystreams\",\n type: \"OrderedCollectionPage\",\n id: `${baseUrl}/followers?page=${page}`,\n partOf: `${baseUrl}/followers`,\n totalItems: followerCount,\n next: hasNext ? `${baseUrl}/followers?page=${page + 1}` : undefined,\n prev: hasPrev ? `${baseUrl}/followers?page=${page - 1}` : undefined,\n orderedItems: paginatedFollowers.map(follower => ({\n id: follower.actor_id,\n type: \"Person\",\n preferredUsername: follower.actor_username || \"unknown\",\n name: follower.actor_display_name || follower.actor_username || \"Unknown User\",\n icon: follower.actor_icon_url\n ? {\n type: \"Image\",\n url: follower.actor_icon_url,\n }\n : undefined,\n url: follower.actor_id,\n summary: follower.actor_domain ? `User from ${follower.actor_domain}` : undefined,\n published: follower.followed_at,\n // Include last activity for debugging\n lastActivity: follower.last_activity_at,\n })),\n };\n\n return c.json(followersPage, 200, {\n \"Content-Type\": \"application/activity+json\",\n });\n } catch (error) {\n console.error(\"ActivityPub followers error:\", error);\n return c.json({ error: \"Failed to generate followers collection\" }, 500);\n }\n});\n\n// ActivityPub following collection (placeholder)\napp.get(\"/following\", async c => {\n try {\n const baseUrl = getBaseUrl(c);\n\n const following = {\n \"@context\": \"https://www.w3.org/ns/activitystreams\",\n type: \"OrderedCollection\",\n id: `${baseUrl}/following`,\n totalItems: 0,\n orderedItems: [],\n };\n\n return c.json(following, 200, {\n \"Content-Type\": \"application/activity+json\",\n });\n } catch (error) {\n console.error(\"ActivityPub following error:\", error);\n return c.json({ error: \"Failed to generate following collection\" }, 500);\n }\n});\n\n// WebFinger endpoint for ActivityPub discovery\napp.get(\"/.well-known/webfinger\", async c => {\n const startTime = Date.now();\n console.log(\"🔍 === WEBFINGER ENDPOINT START ===\");\n\n try {\n const resource = c.req.query(\"resource\");\n const baseUrl = getBaseUrl(c);\n const domain = new URL(baseUrl).hostname;\n\n // Log request details\n const userAgent = c.req.header(\"user-agent\") || \"\";\n const referer = c.req.header(\"referer\") || \"\";\n const acceptHeader = c.req.header(\"accept\") || \"\";\n\n console.log(\"📥 WebFinger request details:\", {\n resource,\n baseUrl,\n domain,\n userAgent: userAgent.substring(0, 100) + (userAgent.length > 100 ? \"...\" : \"\"),\n referer,\n acceptHeader,\n method: c.req.method,\n url: c.req.url,\n allQueryParams: Object.fromEntries(new URL(c.req.url).searchParams.entries()),\n headers: Object.fromEntries(\n Object.entries(c.req.header()).filter(([key]) =>\n [\"accept\", \"user-agent\", \"authorization\", \"content-type\", \"host\", \"origin\"].includes(key.toLowerCase())\n ),\n ),\n });\n\n if (!resource) {\n console.error(\"❌ Missing resource parameter\");\n const processingTime = Date.now() - startTime;\n console.log(\"💥 WebFinger failed - missing resource\", { processingTimeMs: processingTime });\n return c.json({ error: \"Missing resource parameter\" }, 400);\n }\n\n console.log(\"🔍 Validating resource format:\", { resource });\n if (!isValidWebFingerResource(resource)) {\n console.error(\"❌ Invalid resource format:\", { resource });\n const processingTime = Date.now() - startTime;\n console.log(\"💥 WebFinger failed - invalid format\", { processingTimeMs: processingTime });\n return c.json({ error: \"Invalid resource format\" }, 400);\n }\n\n console.log(\"✅ Resource format is valid\");\n console.log(\"🔧 Generating WebFinger response...\");\n\n const webfingerResponse = generateWebFingerResponse(resource, domain);\n\n console.log(\"📄 WebFinger response generated:\", {\n subject: webfingerResponse?.subject,\n linksCount: webfingerResponse?.links?.length || 0,\n links: webfingerResponse?.links?.map(link => ({\n rel: link.rel,\n type: link.type,\n href: link.href,\n })) || [],\n });\n\n if (!webfingerResponse) {\n console.error(\"❌ Resource not found for domain:\", { resource, domain });\n const processingTime = Date.now() - startTime;\n console.log(\"💥 WebFinger failed - resource not found\", { processingTimeMs: processingTime });\n return c.json({ error: \"Resource not found\" }, 404);\n }\n\n const processingTime = Date.now() - startTime;\n console.log(\"✅ WebFinger response sent successfully\", {\n processingTimeMs: processingTime,\n subject: webfingerResponse.subject,\n linksCount: webfingerResponse.links.length,\n });\n\n return c.json(webfingerResponse, 200, {\n \"Content-Type\": \"application/jrd+json; charset=utf-8\",\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET\",\n \"Access-Control-Allow-Headers\": \"Content-Type\",\n });\n } catch (error) {\n const processingTime = Date.now() - startTime;\n console.error(\"💥 WebFinger error:\", {\n error: error.message,\n stack: error.stack,\n processingTimeMs: processingTime,\n });\n return c.json({ error: \"Internal server error\" }, 500);\n } finally {\n console.log(\"🔍 === WEBFINGER ENDPOINT END ===\");\n }\n});\n\n// Email verification endpoint\napp.get(\"/verify-email\", async c => {\n const startTime = Date.now();\n console.log(\"🔐 === EMAIL VERIFICATION START ===\");\n\n try {\n await ensureDbInitialized();\n const token = c.req.query(\"token\");\n\n console.log(\"📧 Verification request:\", {\n hasToken: !!token,\n tokenLength: token?.length || 0,\n tokenPreview: token ? token.substring(0, 10) + \"...\" : null,\n userAgent: c.req.header(\"user-agent\"),\n referer: c.req.header(\"referer\"),\n });\n\n if (!token) {\n console.error(\"❌ Missing verification token\");\n return c.html(generateVerificationErrorHTML(\"Missing verification token\"), 400);\n }\n\n console.log(\"🔍 Looking up verification record...\");\n // Get verification record\n const verification = await getEmailVerificationByToken(token);\n if (!verification) {\n console.error(\"❌ Verification record not found:\", {\n token: token.substring(0, 10) + \"...\",\n });\n return c.html(generateVerificationErrorHTML(\"Invalid or expired verification token\"), 404);\n }\n\n console.log(\"✅ Verification record found:\", {\n id: verification.id,\n email: verification.email,\n draftPostId: verification.draft_post_id,\n expiresAt: verification.expires_at,\n verifiedAt: verification.verified_at,\n createdAt: verification.created_at,\n });\n\n // Check if already verified\n if (verification.verified_at) {\n console.log(\"⚠️ Post already verified:\", {\n verifiedAt: verification.verified_at,\n });\n return c.html(generateVerificationSuccessHTML(\"This post has already been verified and published!\", true));\n }\n\n // Check if expired\n const now = new Date();\n const expiresAt = new Date(verification.expires_at);\n if (expiresAt < now) {\n console.error(\"❌ Verification token expired:\", {\n expiresAt: verification.expires_at,\n currentTime: now.toISOString(),\n expiredBy: Math.round((now.getTime() - expiresAt.getTime()) / (1000 * 60)) + \" minutes\",\n });\n return c.html(generateVerificationErrorHTML(\"Verification token has expired\"), 410);\n }\n\n console.log(\"✅ Token is valid, proceeding with verification...\");\n\n try {\n console.log(\"📝 Marking email as verified...\");\n // Mark as verified and publish the post\n await markEmailVerified(token);\n console.log(\"✅ Email marked as verified\");\n\n console.log(\"📤 Publishing draft post...\");\n const post = await publishDraftPost(token);\n console.log(\"✅ Draft post published successfully:\", {\n id: post.id,\n title: post.title,\n slug: post.slug,\n });\n\n // Notify external services\n console.log(\"📡 Notifying external services...\");\n const serviceResults = await Promise.allSettled([\n notifyWebSubSubscribers().then(() => ({ service: \"WebSub\", success: true })).catch(err => ({\n service: \"WebSub\",\n success: false,\n error: err.message,\n })),\n publishToActivityPub(post).then(() => ({ service: \"ActivityPub\", success: true })).catch(err => ({\n service: \"ActivityPub\",\n success: false,\n error: err.message,\n })),\n publishToATProtocol(post).then(() => ({ service: \"AT Protocol\", success: true })).catch(err => ({\n service: \"AT Protocol\",\n success: false,\n error: err.message,\n })),\n ]);\n\n // Log service notification results\n serviceResults.forEach((result, index) => {\n if (result.status === \"fulfilled\") {\n const serviceResult = result.value;\n if (serviceResult.success) {\n console.log(`✅ ${serviceResult.service} notification successful`);\n } else {\n console.error(`❌ ${serviceResult.service} notification failed:`, serviceResult.error);\n }\n } else {\n console.error(`💥 Service notification crashed:`, result.reason);\n }\n });\n\n const successfulServices = serviceResults.filter(r => r.status === \"fulfilled\" && r.value.success).length;\n const totalServices = serviceResults.length;\n console.log(\"📊 Service notification summary:\", {\n successful: successfulServices,\n total: totalServices,\n successRate: `${Math.round((successfulServices / totalServices) * 100)}%`,\n });\n\n console.log(`🎉 Post published successfully: ${post.title} (${post.slug})`);\n\n const baseUrl = getBaseUrl(c);\n const postUrl = `${baseUrl}/post/${post.slug}`;\n\n const processingTime = Date.now() - startTime;\n console.log(\"✅ === EMAIL VERIFICATION COMPLETED ===\", {\n processingTimeMs: processingTime,\n postUrl: postUrl,\n });\n\n return c.html(generateVerificationSuccessHTML(\n `Your post \"${post.title}\" has been verified and published successfully!`,\n false,\n postUrl,\n ));\n } catch (publishError) {\n const processingTime = Date.now() - startTime;\n console.error(\"💥 Error publishing post:\", {\n error: publishError.message,\n stack: publishError.stack,\n processingTimeMs: processingTime,\n token: token.substring(0, 10) + \"...\",\n });\n return c.html(generateVerificationErrorHTML(\"Failed to publish post. Please try again.\"), 500);\n }\n } catch (error) {\n const processingTime = Date.now() - startTime;\n console.error(\"💥 Email verification error:\", {\n error: error.message,\n stack: error.stack,\n processingTimeMs: processingTime,\n });\n return c.html(generateVerificationErrorHTML(\"An error occurred during verification\"), 500);\n } finally {\n console.log(\"🔐 === EMAIL VERIFICATION END ===\");\n }\n});\n\n// ===== IMAGE ROUTES =====\n\n// Serve image upload page\napp.get(\"/upload\", async c => {\n try {\n // Check if upload is enabled\n if (!isUploadEnabled()) {\n return c.html(`\n \n \n \n \n \n Upload Disabled - Posterous Blog\n \n \n \n

Upload Disabled

Image upload is currently disabled.

Administrator: Set the UPLOAD_PASSWORD environment variable to enable uploads.

\n ← Back to Blog\n

\n \n \n `);\n }\n\n const html = await readFile(\"/frontend/upload.html\", import.meta.url);\n return c.html(html);\n } catch (error) {\n console.error(\"Error serving upload page:\", error);\n return c.text(\"Error loading upload page\", 500);\n }\n});\n\n// Serve images\napp.get(\"/images/:filename\", async c => {\n try {\n await ensureDbInitialized();\n const filename = c.req.param(\"filename\");\n\n const imageData = await getImageData(filename);\n if (!imageData) {\n return c.text(\"Image not found\", 404);\n }\n\n // Return the image data as a proper Response\n return new Response(imageData.data, {\n headers: {\n \"Content-Type\": imageData.mimeType,\n \"Cache-Control\": \"public, max-age=31536000\", // Cache for 1 year\n },\n });\n } catch (error) {\n console.error(\"Error serving image:\", error);\n return c.text(\"Error serving image\", 500);\n }\n});\n\n// Upload image endpoint\napp.post(\"/api/images/upload\", async c => {\n try {\n await ensureDbInitialized();\n\n // Get the uploaded file and form data\n const body = await c.req.formData();\n const file = body.get(\"image\") as File;\n const password = body.get(\"password\") as string;\n const uploaderEmail = body.get(\"email\") as string;\n const altText = body.get(\"altText\") as string;\n const postSlug = body.get(\"postSlug\") as string;\n\n if (!file) {\n return c.json({ error: \"No image file provided\" }, 400);\n }\n\n if (!password) {\n return c.json({ error: \"Password is required\" }, 400);\n }\n\n if (!uploaderEmail) {\n return c.json({ error: \"Email is required\" }, 400);\n }\n\n // Validate upload password\n if (!validateUploadPassword(password)) {\n console.log(`❌ Invalid upload password attempt from ${uploaderEmail}`);\n return c.json({ error: \"Invalid password\" }, 403);\n }\n\n console.log(`✅ Valid upload password from ${uploaderEmail}`);\n\n // Store the image\n const image = await storeImageFromFile(file, uploaderEmail, {\n altText: altText || undefined,\n postSlug: postSlug || undefined,\n });\n\n const baseUrl = getBaseUrl(c);\n const imageUrl = getImageUrl(image.filename, baseUrl);\n\n return c.json({\n success: true,\n image: {\n id: image.id,\n filename: image.filename,\n originalFilename: image.original_filename,\n url: imageUrl,\n mimeType: image.mime_type,\n fileSize: image.file_size,\n altText: image.alt_text,\n postSlug: image.post_slug,\n createdAt: image.created_at,\n },\n });\n } catch (error) {\n console.error(\"Error uploading image:\", error);\n return c.json({ error: error.message || \"Failed to upload image\" }, 500);\n }\n});\n\n// Get images for a specific post\napp.get(\"/api/posts/:slug/images\", async c => {\n try {\n await ensureDbInitialized();\n const slug = c.req.param(\"slug\");\n\n const images = await getImagesByPostSlug(slug);\n const baseUrl = getBaseUrl(c);\n\n return c.json({\n images: images.map(image => ({\n id: image.id,\n filename: image.filename,\n originalFilename: image.original_filename,\n url: getImageUrl(image.filename, baseUrl),\n mimeType: image.mime_type,\n fileSize: image.file_size,\n altText: image.alt_text,\n createdAt: image.created_at,\n })),\n });\n } catch (error) {\n console.error(\"Error fetching post images:\", error);\n return c.json({ error: \"Failed to fetch images\" }, 500);\n }\n});\n\n// Get images uploaded by a user\napp.get(\"/api/images/user/:email\", async c => {\n try {\n await ensureDbInitialized();\n const email = c.req.param(\"email\");\n\n // Check password for access\n const password = c.req.query(\"password\");\n if (!password || !validateUploadPassword(password)) {\n return c.json({ error: \"Invalid password\" }, 403);\n }\n\n const images = await getImagesByUser(email);\n const baseUrl = getBaseUrl(c);\n\n return c.json({\n images: images.map(image => ({\n id: image.id,\n filename: image.filename,\n originalFilename: image.original_filename,\n url: getImageUrl(image.filename, baseUrl),\n mimeType: image.mime_type,\n fileSize: image.file_size,\n altText: image.alt_text,\n postSlug: image.post_slug,\n createdAt: image.created_at,\n })),\n });\n } catch (error) {\n console.error(\"Error fetching user images:\", error);\n return c.json({ error: \"Failed to fetch images\" }, 500);\n }\n});\n\n// Delete an image\napp.delete(\"/api/images/:filename\", async c => {\n try {\n await ensureDbInitialized();\n const filename = c.req.param(\"filename\");\n const password = c.req.query(\"password\");\n\n if (!password || !validateUploadPassword(password)) {\n return c.json({ error: \"Invalid password\" }, 403);\n }\n\n const success = await deleteImageCompletely(filename);\n\n if (!success) {\n return c.json({ error: \"Image not found\" }, 404);\n }\n\n return c.json({ success: true, message: \"Image deleted successfully\" });\n } catch (error) {\n console.error(\"Error deleting image:\", error);\n return c.json({ error: \"Failed to delete image\" }, 500);\n }\n});\n\n// Get all images (admin endpoint)\napp.get(\"/api/images\", async c => {\n try {\n await ensureDbInitialized();\n const password = c.req.query(\"password\");\n\n if (!password || !validateUploadPassword(password)) {\n return c.json({ error: \"Invalid password\" }, 403);\n }\n\n const limit = parseInt(c.req.query(\"limit\") || \"50\");\n const offset = parseInt(c.req.query(\"offset\") || \"0\");\n\n const images = await getAllImages(limit, offset);\n const baseUrl = getBaseUrl(c);\n\n return c.json({\n images: images.map(image => ({\n id: image.id,\n filename: image.filename,\n originalFilename: image.original_filename,\n url: getImageUrl(image.filename, baseUrl),\n mimeType: image.mime_type,\n fileSize: image.file_size,\n altText: image.alt_text,\n postSlug: image.post_slug,\n uploadedByEmail: image.uploaded_by_email,\n createdAt: image.created_at,\n })),\n pagination: {\n limit,\n offset,\n hasMore: images.length === limit,\n },\n });\n } catch (error) {\n console.error(\"Error fetching all images:\", error);\n return c.json({ error: \"Failed to fetch images\" }, 500);\n }\n});\n\n// Health check\napp.get(\"/health\", c => {\n return c.json({ status: \"ok\", timestamp: new Date().toISOString() });\n});\n\nexport default app.fetch;",[],[280,432],"a448d282-69a3-11f0-aa22-0224a6c84d84","websub.ts","0198439f-c37b-732a-a383-a8c14c7944b5","0198439f-c37b-732a-a383-ae623e285803",["D",1753481200444],"import { getActiveWebSubSubscriptions, addWebSubSubscription } from \"../database/queries.ts\";\n\n/**\n * Notify WebSub subscribers of new content\n */\nexport async function notifyWebSubSubscribers(): Promise {\n const hubUrl = Deno.env.get('WEBSUB_HUB_URL');\n if (!hubUrl) {\n console.log('WebSub hub URL not configured, skipping notifications');\n return;\n }\n\n try {\n const subscriptions = await getActiveWebSubSubscribers();\n \n if (subscriptions.length === 0) {\n console.log('No active WebSub subscriptions found');\n return;\n }\n\n // Notify the hub that our feed has been updated\n const topicUrl = `${getBaseUrl()}/rss`;\n \n const formData = new FormData();\n formData.append('hub.mode', 'publish');\n formData.append('hub.url', topicUrl);\n\n const response = await fetch(hubUrl, {\n method: 'POST',\n body: formData\n });\n\n if (response.ok) {\n console.log(`WebSub hub notified successfully for ${subscriptions.length} subscriptions`);\n } else {\n console.error('Failed to notify WebSub hub:', response.status, await response.text());\n }\n } catch (error) {\n console.error('Error notifying WebSub subscribers:', error);\n throw error;\n }\n}\n\n/**\n * Handle WebSub subscription requests\n */\nexport async function handleWebSubSubscription(\n mode: string,\n callback: string,\n topic: string,\n challenge?: string,\n leaseSeconds?: number,\n secret?: string\n): Promise {\n const expectedTopic = `${getBaseUrl()}/rss`;\n \n if (topic !== expectedTopic) {\n throw new Error(`Invalid topic URL: ${topic}`);\n }\n\n if (mode === 'subscribe') {\n // Store subscription (will be verified when challenge is confirmed)\n await addWebSubSubscription(callback, topic, leaseSeconds, secret);\n \n if (challenge) {\n // Verify the subscription by returning the challenge\n return challenge;\n }\n } else if (mode === 'unsubscribe') {\n // Handle unsubscription\n await removeWebSubSubscription(callback);\n \n if (challenge) {\n return challenge;\n }\n }\n\n return null;\n}\n\nfunction getBaseUrl(): string {\n // In Val Town, we can construct the base URL from the current environment\n // This would need to be configured based on your actual domain\n return 'https://your-val-name.web.val.run';\n}\n\n// Helper function to remove subscription (implement in queries.ts if needed)\nasync function removeWebSubSubscription(callbackUrl: string): Promise {\n // Implementation would go in queries.ts\n console.log(`Removing WebSub subscription for ${callbackUrl}`);\n}",[],[280,446,439],"services","a448cd82-69a3-11f0-aa22-0224a6c84d84","webfinger.ts","0198439f-c37b-732a-a383-a68f2a000f40",["D",1753481200444],"/**\n * WebFinger implementation for ActivityPub discovery\n *\n * WebFinger allows users to discover ActivityPub actors using the format:\n * acct:username@domain.com\n *\n * The WebFinger endpoint is typically at:\n * /.well-known/webfinger?resource=acct:username@domain.com\n */\n\nexport interface WebFingerResource {\n subject: string;\n aliases?: string[];\n properties?: { [key: string]: string | null };\n links: WebFingerLink[];\n}\n\nexport interface WebFingerLink {\n rel: string;\n type?: string;\n href?: string;\n template?: string;\n titles?: { [lang: string]: string };\n properties?: { [key: string]: string | null };\n}\n\n/**\n * Generate WebFinger response for the blog actor\n */\nexport function generateWebFingerResponse(resource: string, domain: string): WebFingerResource | null {\n console.log(\"🔧 Generating WebFinger response:\", { resource, domain });\n\n // Parse the resource parameter\n // Expected formats:\n // - acct:blog@domain.com\n // - acct:username@domain.com\n // - https://domain.com/actor\n\n let username: string;\n let requestedDomain: string;\n\n if (resource.startsWith(\"acct:\")) {\n const acctPart = resource.substring(5); // Remove 'acct:' prefix\n const parts = acctPart.split(\"@\");\n console.log(\"📧 Parsing acct resource:\", { acctPart, parts });\n\n if (parts.length !== 2) {\n console.error(\"❌ Invalid acct format - wrong number of parts:\", { parts });\n return null;\n }\n username = parts[0];\n requestedDomain = parts[1];\n } else if (resource.startsWith(\"https://\")) {\n // Handle direct actor URL requests\n console.log(\"🌐 Parsing URL resource:\", { resource });\n try {\n const url = new URL(resource);\n console.log(\"🔗 Parsed URL:\", { hostname: url.hostname, pathname: url.pathname });\n\n if (url.pathname === \"/actor\") {\n requestedDomain = url.hostname;\n username = \"blog\"; // Default username for the blog\n } else {\n console.error(\"❌ URL path is not /actor:\", { pathname: url.pathname });\n return null;\n }\n } catch (error) {\n console.error(\"❌ Failed to parse URL:\", { resource, error: error.message });\n return null;\n }\n } else {\n console.error(\"❌ Resource format not supported:\", { resource });\n return null;\n }\n\n console.log(\"🔍 Parsed resource:\", { username, requestedDomain, expectedDomain: domain });\n\n // Verify the domain matches\n if (requestedDomain !== domain) {\n console.error(\"❌ Domain mismatch:\", { requestedDomain, expectedDomain: domain });\n return null;\n }\n\n // For now, we only support the main blog actor\n // In a multi-user system, you'd check if the username exists\n if (username !== \"blog\") {\n console.error(\"❌ Username not supported:\", { username, supportedUsername: \"blog\" });\n return null;\n }\n\n const actorUrl = `https://${domain}/actor`;\n const profileUrl = `https://${domain}/`;\n\n const response = {\n subject: `acct:${username}@${domain}`,\n aliases: [\n actorUrl,\n /* profileUrl,\n actorUrl,*/\n ],\n properties: {\n \"http://schema.org/name\": \"Email Blog\",\n },\n links: [\n {\n rel: \"http://webfinger.net/rel/profile-page\",\n type: \"text/html\",\n href: actorUrl,\n },\n {\n rel: \"self\",\n type: \"application/activity+json\",\n href: actorUrl,\n },\n {\n rel: \"http://ostatus.org/schema/1.0/subscribe\",\n template: `https://${domain}/authorize_interaction?uri={uri}`,\n },\n {\n \"rel\": \"http://webfinger.net/rel/avatar\",\n \"type\": \"image/png\",\n \"href\": \"https://posthero.us/images/1752442753496-q8omo6-logo-small.png\",\n },\n ],\n };\n\n console.log(\"✅ WebFinger response generated successfully:\", {\n subject: response.subject,\n aliasesCount: response.aliases.length,\n linksCount: response.links.length,\n actorUrl,\n profileUrl,\n });\n\n return response;\n}\n\n/**\n * Validate WebFinger resource parameter\n */\nexport function isValidWebFingerResource(resource: string): boolean {\n console.log(\"🔍 Validating WebFinger resource:\", { resource });\n\n if (!resource) {\n console.error(\"❌ Resource is empty or null\");\n return false;\n }\n\n // Check for acct: format\n if (resource.startsWith(\"acct:\")) {\n const acctPart = resource.substring(5);\n const parts = acctPart.split(\"@\");\n const isValid = parts.length === 2 && parts[0].length > 0 && parts[1].length > 0;\n\n console.log(\"📧 Validating acct format:\", {\n acctPart,\n parts,\n isValid,\n username: parts[0] || null,\n domain: parts[1] || null,\n });\n\n return isValid;\n }\n\n // Check for direct URL format\n if (resource.startsWith(\"https://\")) {\n try {\n const url = new URL(resource);\n console.log(\"🌐 Validating URL format:\", {\n hostname: url.hostname,\n pathname: url.pathname,\n isValid: true,\n });\n return true;\n } catch (error) {\n console.error(\"❌ Invalid URL format:\", { resource, error: error.message });\n return false;\n }\n }\n\n console.error(\"❌ Unsupported resource format:\", { resource });\n return false;\n}\n\n/**\n * Extract domain from various sources\n */\nexport function extractDomain(request: Request): string {\n // Try to get domain from BASE_URL environment variable first (for custom domains)\n const baseUrl = Deno.env.get(\"BASE_URL\");\n if (baseUrl) {\n try {\n // Handle BASE_URL with or without protocol\n let urlToProcess = baseUrl;\n if (!baseUrl.startsWith(\"http://\") && !baseUrl.startsWith(\"https://\")) {\n urlToProcess = `https://${baseUrl}`;\n }\n const url = new URL(urlToProcess);\n return url.hostname;\n } catch {\n // If BASE_URL is malformed, fall through to other methods\n }\n }\n\n // Try to get domain from ACTIVITYPUB_DOMAIN environment variable\n const envDomain = Deno.env.get(\"ACTIVITYPUB_DOMAIN\");\n if (envDomain) {\n return envDomain;\n }\n\n // Fall back to Host header\n const host = request.headers.get(\"host\");\n if (host) {\n return host;\n }\n\n // Last resort: try to extract from URL\n try {\n const url = new URL(request.url);\n return url.hostname;\n } catch {\n return \"localhost\";\n }\n}",[],[280,446,448],"a448ca26-69a3-11f0-aa22-0224a6c84d84","rss.ts","0198439f-c37b-732a-a383-a212f027187d",["D",1753481200444],"import { BlogPost, RSSItem } from \"../../shared/types.ts\";\nimport { formatRSSDate, truncateHTML } from \"../../shared/utils.ts\";\n\n/**\n * Generate RSS 2.0 feed XML\n */\nexport function generateRSSFeed(posts: BlogPost[], baseUrl: string): string {\n const now = new Date();\n const items = posts.map(post => generateRSSItem(post, baseUrl));\n \n const rssXML = `\n\n \n Email Blog\n ${baseUrl}\n A blog powered by email publishing\n en-us\n ${formatRSSDate(now)}\n Email Blog Platform\n \n blog@${getDomain(baseUrl)} (Email Blog)\n blog@${getDomain(baseUrl)} (Email Blog)\n 60\n \n ${items.map(item => `\n \n <![CDATA[${item.title}]]>\n ${item.link}\n ${item.guid}\n \n \n ${item.pubDate}\n ${item.author}\n `).join('')}\n \n`;\n\n return rssXML;\n}\n\n/**\n * Generate RSS item from blog post\n */\nfunction generateRSSItem(post: BlogPost, baseUrl: string): RSSItem & { content: string } {\n const link = `${baseUrl}/post/${post.slug}`;\n const description = truncateHTML(post.content, 300);\n \n return {\n title: post.title,\n link,\n guid: link,\n description,\n content: post.content,\n pubDate: formatRSSDate(new Date(post.published_at)),\n author: `${post.author_email} (${post.author_name || post.author_email})`\n };\n}\n\n/**\n * Extract domain from URL\n */\nfunction getDomain(url: string): string {\n try {\n return new URL(url).hostname;\n } catch {\n return 'localhost';\n }\n}",[],[280,446,455],"a448c40e-69a3-11f0-aa22-0224a6c84d84","images.ts","0198439f-c37b-732a-a383-9c1f24b49231",["D",1753481200444],"import { blob } from \"https://esm.town/v/std/blob\";\nimport { createImage, generateUniqueImageFilename, getImageByFilename, deleteImage } from \"../database/queries.ts\";\nimport { BlogImage, CreateImageData, EmailAttachment } from \"../../shared/types.ts\";\n\n// Supported image MIME types\nconst SUPPORTED_IMAGE_TYPES = [\n 'image/jpeg',\n 'image/jpg', \n 'image/png',\n 'image/gif',\n 'image/webp',\n 'image/svg+xml'\n];\n\n// Maximum file size (5MB)\nconst MAX_FILE_SIZE = 5 * 1024 * 1024;\n\n/**\n * Check if a MIME type is a supported image format\n */\nexport function isSupportedImageType(mimeType: string): boolean {\n return SUPPORTED_IMAGE_TYPES.includes(mimeType.toLowerCase());\n}\n\n/**\n * Validate image file\n */\nexport function validateImageFile(file: { size: number; type: string }): { valid: boolean; error?: string } {\n if (file.size > MAX_FILE_SIZE) {\n return { valid: false, error: `File size too large. Maximum size is ${MAX_FILE_SIZE / (1024 * 1024)}MB` };\n }\n\n if (!isSupportedImageType(file.type)) {\n return { valid: false, error: `Unsupported file type. Supported types: ${SUPPORTED_IMAGE_TYPES.join(', ')}` };\n }\n\n return { valid: true };\n}\n\n/**\n * Store an image from a File object (for uploads)\n */\nexport async function storeImageFromFile(\n file: File, \n uploadedByEmail: string, \n options: {\n altText?: string;\n postSlug?: string;\n } = {}\n): Promise {\n // Validate the file\n const validation = validateImageFile(file);\n if (!validation.valid) {\n throw new Error(validation.error);\n }\n\n // Generate unique filename\n const filename = await generateUniqueImageFilename(file.name);\n const blobKey = `images/${filename}`;\n\n // Read file as array buffer and store in blob\n const arrayBuffer = await file.arrayBuffer();\n await blob.set(blobKey, new Uint8Array(arrayBuffer));\n\n // Try to get image dimensions (basic approach)\n let width: number | undefined;\n let height: number | undefined;\n\n // For now, we'll skip dimension detection as it requires additional libraries\n // In a production environment, you might want to use a library like 'image-size'\n\n // Create image record\n const imageData: CreateImageData = {\n filename,\n original_filename: file.name,\n mime_type: file.type,\n file_size: file.size,\n width,\n height,\n alt_text: options.altText,\n post_slug: options.postSlug,\n uploaded_by_email: uploadedByEmail,\n blob_key: blobKey\n };\n\n return await createImage(imageData);\n}\n\n/**\n * Store an image from base64 data (for email attachments)\n */\nexport async function storeImageFromBase64(\n base64Data: string,\n originalFilename: string,\n mimeType: string,\n uploadedByEmail: string,\n options: {\n altText?: string;\n postSlug?: string;\n } = {}\n): Promise {\n // Convert base64 to Uint8Array\n const binaryString = atob(base64Data);\n const bytes = new Uint8Array(binaryString.length);\n for (let i = 0; i < binaryString.length; i++) {\n bytes[i] = binaryString.charCodeAt(i);\n }\n\n const fileSize = bytes.length;\n\n // Validate the file\n const validation = validateImageFile({ size: fileSize, type: mimeType });\n if (!validation.valid) {\n throw new Error(validation.error);\n }\n\n // Generate unique filename\n const filename = await generateUniqueImageFilename(originalFilename);\n const blobKey = `images/${filename}`;\n\n // Store in blob\n await blob.set(blobKey, bytes);\n\n // Create image record\n const imageData: CreateImageData = {\n filename,\n original_filename: originalFilename,\n mime_type: mimeType,\n file_size: fileSize,\n alt_text: options.altText,\n post_slug: options.postSlug,\n uploaded_by_email: uploadedByEmail,\n blob_key: blobKey\n };\n\n return await createImage(imageData);\n}\n\n/**\n * Get image data from blob storage\n */\nexport async function getImageData(filename: string): Promise<{ data: Uint8Array; mimeType: string } | null> {\n const imageRecord = await getImageByFilename(filename);\n if (!imageRecord) {\n return null;\n }\n\n const blobData = await blob.get(imageRecord.blob_key);\n if (!blobData) {\n return null;\n }\n\n // Handle different types of data that blob.get() might return\n let data: Uint8Array;\n \n if (blobData instanceof Uint8Array) {\n data = blobData;\n } else if (blobData instanceof Response) {\n // If blob.get() returns a Response, extract the array buffer\n const arrayBuffer = await blobData.arrayBuffer();\n data = new Uint8Array(arrayBuffer);\n } else if (blobData instanceof ArrayBuffer) {\n data = new Uint8Array(blobData);\n } else {\n console.error('Unexpected blob data type:', typeof blobData, blobData?.constructor?.name);\n return null;\n }\n\n return {\n data,\n mimeType: imageRecord.mime_type\n };\n}\n\n/**\n * Delete an image (both record and blob data)\n */\nexport async function deleteImageCompletely(filename: string): Promise {\n const imageRecord = await getImageByFilename(filename);\n if (!imageRecord) {\n return false;\n }\n\n // Delete from blob storage\n await blob.delete(imageRecord.blob_key);\n\n // Delete from database\n return await deleteImage(filename);\n}\n\n/**\n * Process email attachments and extract images\n */\nexport async function processEmailAttachments(\n attachments: EmailAttachment[],\n uploadedByEmail: string,\n postSlug?: string\n): Promise {\n const images: BlogImage[] = [];\n\n for (const attachment of attachments) {\n if (isSupportedImageType(attachment.contentType)) {\n try {\n const image = await storeImageFromBase64(\n attachment.content,\n attachment.filename,\n attachment.contentType,\n uploadedByEmail,\n { postSlug }\n );\n images.push(image);\n console.log(`✅ Processed email attachment image: ${attachment.filename} -> ${image.filename}`);\n } catch (error) {\n console.error(`❌ Failed to process email attachment ${attachment.filename}:`, error);\n }\n }\n }\n\n return images;\n}\n\n/**\n * Generate image URL for serving\n */\nexport function getImageUrl(filename: string, baseUrl?: string): string {\n const base = baseUrl || '';\n return `${base}/images/${filename}`;\n}\n\n/**\n * Replace image references in content with proper URLs\n */\nexport function replaceImageReferencesInContent(content: string, images: BlogImage[], baseUrl?: string): string {\n let updatedContent = content;\n\n for (const image of images) {\n const imageUrl = getImageUrl(image.filename, baseUrl);\n \n // Replace various possible references to the original filename\n const patterns = [\n new RegExp(`cid:${image.original_filename}`, 'gi'),\n new RegExp(`src=\"${image.original_filename}\"`, 'gi'),\n new RegExp(`src='${image.original_filename}'`, 'gi'),\n new RegExp(`\\\\[${image.original_filename}\\\\]`, 'gi'),\n new RegExp(`\\\$${image.original_filename}\\\$`, 'gi')\n ];\n\n for (const pattern of patterns) {\n if (pattern.source.includes('src=')) {\n updatedContent = updatedContent.replace(pattern, `src=\"${imageUrl}\"`);\n } else if (pattern.source.includes('cid:')) {\n updatedContent = updatedContent.replace(pattern, imageUrl);\n } else {\n updatedContent = updatedContent.replace(pattern, `![${image.alt_text || image.original_filename}](${imageUrl})`);\n }\n }\n }\n\n return updatedContent;\n}",[],[280,446,462],"a448bbf8-69a3-11f0-aa22-0224a6c84d84","http-signatures.ts","0198439f-c37b-732a-a383-98a126d82ba2",["D",1753481200444],"/**\n * HTTP Signatures implementation for ActivityPub\n * Based on the HTTP Signatures specification: https://tools.ietf.org/html/draft-cavage-http-signatures\n */\n\n// Store for RSA key pair (cached after first load)\nlet keyPairCache: { publicKey: CryptoKey; privateKey: CryptoKey; publicKeyPem: string } | null = null;\n\n/**\n * Format a PEM key with proper line breaks\n */\nfunction formatPemKey(pemKey: string, keyType: string): string {\n // Remove existing headers, footers, and whitespace\n const keyContent = pemKey\n .replace(/-----BEGIN [^-]+-----/g, \"\")\n .replace(/-----END [^-]+-----/g, \"\")\n .replace(/\\s/g, \"\");\n\n // Split into 64-character lines\n const lines = keyContent.match(/.{1,64}/g) || [];\n\n // Reconstruct with proper formatting. NOTE KEEP FORMATTING AS IS\n return `-----BEGIN ${keyType}-----\n${lines.join(\"\\n\")}\n-----END ${keyType}-----`;\n}\n\n/**\n * Get the RSA key pair for HTTP signatures from environment variables\n */\nasync function getKeyPair(): Promise<{ publicKey: CryptoKey; privateKey: CryptoKey; publicKeyPem: string }> {\n if (keyPairCache) {\n return keyPairCache;\n }\n\n try {\n // Try to load keys from environment variables first\n const publicKeyPem = Deno.env.get(\"ACTIVITYPUB_PUBLIC_KEY\");\n const privateKeyPem = Deno.env.get(\"ACTIVITYPUB_PRIVATE_KEY\");\n\n if (publicKeyPem && privateKeyPem) {\n console.log(\"🔐 Loading RSA key pair from environment variables...\");\n \n console.log('🔍 KEY IMPORT DETAILS:');\n console.log('- Public key PEM length:', publicKeyPem.length);\n console.log('- Private key PEM length:', privateKeyPem.length);\n\n // Import public key\n const publicKeyBuffer = Uint8Array.from(\n atob(publicKeyPem.replace(/-----BEGIN PUBLIC KEY-----|\\n|-----END PUBLIC KEY-----/g, \"\")),\n c => c.charCodeAt(0),\n );\n \n console.log('- Public key buffer length:', publicKeyBuffer.length);\n console.log('- Expected buffer length for RSA-2048 public key:', 294, 'bytes (approx)');\n \n const publicKey = await crypto.subtle.importKey(\n \"spki\",\n publicKeyBuffer,\n {\n name: \"RSASSA-PKCS1-v1_5\",\n hash: \"SHA-256\",\n },\n false,\n [\"verify\"],\n );\n\n // Import private key\n const privateKeyBuffer = Uint8Array.from(\n atob(privateKeyPem.replace(/-----BEGIN PRIVATE KEY-----|\\n|-----END PRIVATE KEY-----/g, \"\")),\n c => c.charCodeAt(0),\n );\n \n console.log('- Private key buffer length:', privateKeyBuffer.length);\n console.log('- Expected buffer length for RSA-2048 private key:', 1200, 'bytes (approx)');\n \n const privateKey = await crypto.subtle.importKey(\n \"pkcs8\",\n privateKeyBuffer,\n {\n name: \"RSASSA-PKCS1-v1_5\",\n hash: \"SHA-256\",\n },\n false,\n [\"sign\"],\n );\n\n keyPairCache = {\n publicKey,\n privateKey,\n publicKeyPem: formatPemKey(publicKeyPem, \"PUBLIC KEY\"),\n };\n\n console.log(\"✅ RSA key pair loaded from environment variables\");\n return keyPairCache;\n }\n\n // Fallback: Generate temporary keys (not recommended for production)\n console.log(\"⚠️ No persistent keys found in environment variables\");\n console.log(\"🔐 Generating temporary RSA key pair (will change on restart)...\");\n\n const keyPair = await crypto.subtle.generateKey(\n {\n name: \"RSASSA-PKCS1-v1_5\",\n modulusLength: 2048,\n publicExponent: new Uint8Array([1, 0, 1]),\n hash: \"SHA-256\",\n },\n true, // extractable\n [\"sign\", \"verify\"],\n );\n\n // Export public key to PEM format\n const publicKeyBuffer = await crypto.subtle.exportKey(\"spki\", keyPair.publicKey);\n const publicKeyBase64 = btoa(String.fromCharCode(...new Uint8Array(publicKeyBuffer)));\n const generatedPublicKeyPem = `-----BEGIN PUBLIC KEY-----\n${publicKeyBase64.match(/.{1,64}/g)?.join(\"\\n\")}\n-----END PUBLIC KEY-----\\n'`;\n\n keyPairCache = {\n publicKey: keyPair.publicKey,\n privateKey: keyPair.privateKey,\n publicKeyPem: generatedPublicKeyPem,\n };\n\n console.log(\n \"⚠️ Temporary RSA key pair generated - set ACTIVITYPUB_PUBLIC_KEY and ACTIVITYPUB_PRIVATE_KEY for persistence\",\n );\n return keyPairCache;\n } catch (error) {\n console.error(\"❌ Failed to load/generate RSA key pair:\", error);\n throw error;\n }\n}\n\n/**\n * Create HTTP signature for ActivityPub request\n */\nexport async function createHttpSignature(\n method: string,\n url: string,\n headers: Record,\n body?: string,\n actorBaseUrl?: string,\n): Promise {\n try {\n const urlObj = new URL(url);\n const host = urlObj.host;\n const path = urlObj.pathname + urlObj.search;\n const date = headers[\"date\"] || new Date().toUTCString();\n\n // Create the signing string\n const signingStringParts = [\n `(request-target): ${method.toLowerCase()} ${path}`,\n `host: ${host}`,\n `date: ${date}`,\n ];\n\n if (body && (headers[\"digest\"] || headers[\"Digest\"])) {\n const digestValue = headers[\"digest\"] || headers[\"Digest\"];\n signingStringParts.push(`digest: ${digestValue}`);\n }\n\n const signingString = signingStringParts.join(\"\\n\");\n\n console.log(\"📝 HTTP Signature signing string created:\", {\n method,\n host,\n path,\n date,\n hasDigest: !!(body && (headers[\"digest\"] || headers[\"Digest\"])),\n signingStringLength: signingString.length,\n });\n \n console.log('🔍 DETAILED SIGNING STRING:');\n console.log('---START---');\n console.log(signingString);\n console.log('---END---');\n \n if (body) {\n console.log('📦 REQUEST BODY DETAILS:');\n console.log('Body length:', body.length);\n console.log('Body preview:', body.substring(0, 200) + '...');\n console.log('Digest header (lowercase):', headers[\"digest\"]);\n console.log('Digest header (capitalized):', headers[\"Digest\"]);\n }\n\n // Get key pair\n const { privateKey } = await getKeyPair();\n\n // Sign the signing string\n const encoder = new TextEncoder();\n const data = encoder.encode(signingString);\n const signatureBuffer = await crypto.subtle.sign(\n \"RSASSA-PKCS1-v1_5\",\n privateKey,\n data,\n );\n\n // Convert signature to base64\n const signatureBase64 = btoa(String.fromCharCode(...new Uint8Array(signatureBuffer)));\n\n // Create signature header - keyId should point to YOUR actor, not the target\n // Use provided actorBaseUrl or try to determine from environment\n let keyId: string;\n if (actorBaseUrl) {\n keyId = `${actorBaseUrl}/actor#main-key`;\n } else {\n // Fallback: try to get from environment variables\n const baseUrl = Deno.env.get(\"BASE_URL\");\n if (baseUrl) {\n const cleanBaseUrl = baseUrl.startsWith(\"http\") ? baseUrl : `https://${baseUrl}`;\n keyId = `${cleanBaseUrl}/actor#main-key`;\n } else {\n // Last resort: use a placeholder (this should be avoided)\n console.warn(\"⚠️ No actorBaseUrl provided and BASE_URL not set - using placeholder keyId\");\n keyId = \"https://your-domain.com/actor#main-key\";\n }\n }\n\n const algorithm = \"rsa-sha256\";\n const headersList = body ? \"(request-target) host date digest\" : \"(request-target) host date\";\n\n const signatureHeader =\n `keyId=\"${keyId}\",algorithm=\"${algorithm}\",headers=\"${headersList}\",signature=\"${signatureBase64}\"`;\n\n console.log(\"✅ HTTP signature created successfully:\", {\n keyId,\n algorithm,\n headers: headersList,\n signatureLength: signatureBase64.length,\n });\n \n console.log('📋 COMPLETE SIGNATURE HEADER:');\n console.log(signatureHeader);\n \n console.log('🔍 SIGNATURE VERIFICATION INFO:');\n console.log('- Public key should be available at:', keyId);\n console.log('- Signature algorithm:', algorithm);\n console.log('- Headers included in signature:', headersList);\n console.log('- Signature base64 (first 50 chars):', signatureBase64.substring(0, 50) + '...');\n\n return signatureHeader;\n } catch (error) {\n console.error(\"❌ Error creating HTTP signature:\", error);\n throw error;\n }\n}\n\n/**\n * Create SHA-256 digest for request body\n */\nexport async function createDigest(body: string): Promise {\n try {\n console.log('🔐 CREATING DIGEST:');\n console.log('- Body length:', body.length);\n console.log('- Body type:', typeof body);\n console.log('- Body preview (first 100 chars):', body.substring(0, 100) + '...');\n \n // Use Web Crypto API to create SHA-256 hash\n const encoder = new TextEncoder();\n const data = encoder.encode(body);\n \n console.log('- Encoded data length:', data.length);\n console.log('- Encoded data preview (hex):', Array.from(data.slice(0, 32)).map(b => b.toString(16).padStart(2, '0')).join(' ') + '...');\n \n const hashBuffer = await crypto.subtle.digest(\"SHA-256\", data);\n const hashArray = new Uint8Array(hashBuffer);\n const hashBase64 = btoa(String.fromCharCode(...hashArray));\n \n console.log('- Hash buffer length:', hashBuffer.byteLength);\n console.log('- Hash array length:', hashArray.length);\n console.log('- Hash base64:', hashBase64);\n \n const digest = `SHA-256=${hashBase64}`;\n console.log('- Final digest:', digest);\n \n return digest;\n } catch (error) {\n console.error(\"❌ Error creating digest:\", error);\n throw error;\n }\n}\n\n/**\n * Check if HTTP signatures are properly configured\n */\nexport function isHttpSignaturesEnabled(): boolean {\n // Enable HTTP signatures now that we have a proper implementation\n return true;\n}\n\n/**\n * Get the public key PEM for the actor document\n */\nexport async function getPublicKeyPem(): Promise {\n const { publicKeyPem } = await getKeyPair();\n return publicKeyPem;\n}\n\n/**\n * Create headers for ActivityPub request with optional HTTP signature\n */\nexport async function createActivityPubHeaders(\n method: string,\n url: string,\n body?: string,\n actorBaseUrl?: string,\n): Promise> {\n const headers: Record = {\n \"Content-Type\": \"application/activity+json\",\n \"Accept\": \"application/activity+json\",\n \"User-Agent\": \"EmailBlog/1.0 (ActivityPub Bot)\",\n \"Date\": new Date().toUTCString(),\n };\n\n if (body) {\n headers[\"Digest\"] = await createDigest(body);\n }\n\n if (isHttpSignaturesEnabled()) {\n try {\n headers[\"Signature\"] = await createHttpSignature(method, url, headers, body, actorBaseUrl);\n console.log(\"✅ HTTP signature added to headers\");\n } catch (error) {\n console.error(\"❌ Failed to create HTTP signature, proceeding without:\", error.message);\n }\n } else {\n console.log(\"⚠️ HTTP signatures disabled - some servers may reject unsigned requests\");\n }\n\n return headers;\n}",[],[280,446,469],"a448b59a-69a3-11f0-aa22-0224a6c84d84","email-security.ts","0198439f-c37b-732a-a383-95409466056c",["D",1753481200444],"import { email } from \"https://esm.town/v/std/email\";\n\n/**\n * Extract email address from display name format\n */\nfunction extractEmailAddress(emailString: string): string {\n // Handle formats like \"Display Name \" or just \"email@domain.com\"\n const match = emailString.match(/<([^>]+)>/);\n if (match) {\n return match[1].trim();\n }\n return emailString.trim();\n}\n\n/**\n * Check if an email address is in the allowed list\n */\nexport function isEmailAllowed(emailAddress: string): boolean {\n const allowedEmails = Deno.env.get(\"ALLOWED_EMAIL_ADDRESSES\");\n\n console.log(\"🔍 Email allowlist check:\", {\n checkingEmail: emailAddress,\n envVarExists: !!allowedEmails,\n envVarValue: allowedEmails,\n });\n\n if (!allowedEmails) {\n console.error(\"❌ ALLOWED_EMAIL_ADDRESSES environment variable not set. No emails will be allowed.\");\n return false;\n }\n\n // Parse the comma-separated list of allowed emails\n const allowedList = allowedEmails\n .split(\",\")\n .map(email => email.trim().toLowerCase())\n .filter(email => email.length > 0);\n\n console.log(\"📋 Parsed allowed emails:\", {\n rawCount: allowedEmails.split(\",\").length,\n processedCount: allowedList.length,\n allowedList: allowedList,\n });\n\n // Extract the actual email address from display name format\n const extractedEmail = extractEmailAddress(emailAddress);\n const normalizedEmail = extractedEmail.toLowerCase();\n const isAllowed = allowedList.includes(normalizedEmail);\n\n console.log(\"✅ Allowlist result:\", {\n originalEmail: emailAddress,\n extractedEmail: extractedEmail,\n normalizedEmail: normalizedEmail,\n isAllowed: isAllowed,\n matchedAgainst: allowedList,\n });\n\n return isAllowed;\n}\n\n/**\n * Generate a secure random token for verification\n */\nexport function generateVerificationToken(): string {\n const array = new Uint8Array(32);\n crypto.getRandomValues(array);\n return Array.from(array, byte => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/**\n * Send verification email to the sender\n */\nexport async function sendVerificationEmail(\n recipientEmail: string,\n verificationToken: string,\n postTitle: string,\n): Promise {\n console.log(\"📧 Preparing verification email:\", {\n recipientEmail: recipientEmail,\n postTitle: postTitle,\n tokenLength: verificationToken.length,\n });\n\n const baseUrl = Deno.env.get(\"BASE_URL\") || \"https://your-val-town-url.web.val.run\";\n const verificationUrl = `${baseUrl}/verify-email?token=${verificationToken}`;\n\n console.log(\"🔗 Verification URL generated:\", {\n baseUrl: baseUrl,\n fullUrl: verificationUrl,\n });\n\n const subject = `Verify your blog post: ${postTitle}`;\n\n const htmlContent = `\n \n \n

Verify Your Blog Post

Hello,

We received a blog post submission with the title \"${postTitle}\" from this email address.

To confirm that you sent this post and publish it to the blog, please click the verification link below:

\n \n Verify and Publish Post\n \n

Or copy and paste this link into your browser:

\n ${verificationUrl}\n

Important: This verification link will expire in 24 hours for security reasons.

If you did not send this blog post, please ignore this email. The post will not be published without verification.

\n This is an automated message from your blog system. Please do not reply to this email.\n

\n \n \n `;\n\n const textContent = `\nVerify Your Blog Post\n\nHello,\n\nWe received a blog post submission with the title \"${postTitle}\" from this email address.\n\nTo confirm that you sent this post and publish it to the blog, please visit this verification link:\n\n${verificationUrl}\n\nImportant: This verification link will expire in 24 hours for security reasons.\n\nIf you did not send this blog post, please ignore this email. The post will not be published without verification.\n\n---\nThis is an automated message from your blog system. Please do not reply to this email.\n `;\n\n console.log(\"📤 Sending email via Val Town email service:\", {\n to: recipientEmail,\n subject: subject,\n htmlLength: htmlContent.length,\n textLength: textContent.length,\n });\n\n try {\n await email({\n to: recipientEmail,\n subject: subject,\n html: htmlContent,\n text: textContent,\n });\n\n console.log(\"✅ Verification email sent successfully:\", {\n recipientEmail: recipientEmail,\n subject: subject,\n verificationUrl: verificationUrl,\n });\n } catch (error) {\n console.error(\"❌ Failed to send verification email:\", {\n error: error.message,\n stack: error.stack,\n recipientEmail: recipientEmail,\n subject: subject,\n verificationUrl: verificationUrl,\n });\n throw new Error(`Failed to send verification email: ${error.message}`);\n }\n}\n\n/**\n * Calculate expiration time (24 hours from now)\n */\nexport function getVerificationExpiration(): string {\n const expirationTime = new Date();\n expirationTime.setHours(expirationTime.getHours() + 24);\n return expirationTime.toISOString();\n}",[],[280,446,476],"a448b306-69a3-11f0-aa22-0224a6c84d84","auth.ts","0198439f-c37b-732a-a383-92afe0a4dcf1",["D",1753481200444],"/**\n * Authentication service for image uploads and admin functions\n */\n\n/**\n * Validate upload password\n */\nexport function validateUploadPassword(password: string): boolean {\n const requiredPassword = Deno.env.get('UPLOAD_PASSWORD');\n \n if (!requiredPassword) {\n console.error('❌ UPLOAD_PASSWORD environment variable not set');\n return false;\n }\n\n if (!password) {\n return false;\n }\n\n return password === requiredPassword;\n}\n\n/**\n * Generate a secure session token (for future use)\n */\nexport function generateSessionToken(): string {\n const array = new Uint8Array(32);\n crypto.getRandomValues(array);\n return Array.from(array, byte => byte.toString(16).padStart(2, '0')).join('');\n}\n\n/**\n * Hash password for comparison (basic implementation)\n */\nexport async function hashPassword(password: string): Promise {\n const encoder = new TextEncoder();\n const data = encoder.encode(password);\n const hashBuffer = await crypto.subtle.digest('SHA-256', data);\n const hashArray = Array.from(new Uint8Array(hashBuffer));\n return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');\n}\n\n/**\n * Validate admin access (for future admin features)\n */\nexport function validateAdminAccess(password: string): boolean {\n const adminPassword = Deno.env.get('ADMIN_PASSWORD');\n \n if (!adminPassword) {\n // If no admin password is set, fall back to upload password\n return validateUploadPassword(password);\n }\n\n return password === adminPassword;\n}\n\n/**\n * Check if upload functionality is enabled\n */\nexport function isUploadEnabled(): boolean {\n const uploadPassword = Deno.env.get('UPLOAD_PASSWORD');\n return !!uploadPassword;\n}\n\n/**\n * Get upload security info (for debugging)\n */\nexport function getUploadSecurityInfo(): { enabled: boolean; hasPassword: boolean } {\n const uploadPassword = Deno.env.get('UPLOAD_PASSWORD');\n return {\n enabled: !!uploadPassword,\n hasPassword: !!uploadPassword\n };\n}",[],[280,446,483],"a448affa-69a3-11f0-aa22-0224a6c84d84","atprotocol.ts","0198439f-c37b-732a-a383-8eb4383911b7",["D",1753481200444],"import { BlogPost, ATProtoPost } from \"../../shared/types.ts\";\nimport { truncateHTML, createATProtoPostContent } from \"../../shared/utils.ts\";\n\n/**\n * Publish a blog post to AT Protocol (Bluesky)\n */\nexport async function publishToATProtocol(post: BlogPost): Promise {\n const handle = Deno.env.get('ATPROTO_HANDLE');\n const password = Deno.env.get('ATPROTO_PASSWORD');\n \n if (!handle || !password) {\n console.log('AT Protocol credentials not configured, skipping publication');\n return;\n }\n\n try {\n // Create session with Bluesky\n const session = await createATProtoSession(handle, password);\n \n // Prepare post content with proper grapheme limits\n const baseUrl = getBaseUrl();\n const postUrl = `${baseUrl}/post/${post.slug}`;\n const content = createATProtoPostContent(post.title, post.content, postUrl, 300);\n \n // Create AT Protocol post\n const atPost: ATProtoPost = {\n text: content,\n createdAt: new Date().toISOString()\n };\n\n // Add link embed if possible\n if (postUrl) {\n atPost.embed = {\n $type: 'app.bsky.embed.external',\n external: {\n uri: postUrl,\n title: post.title,\n description: truncateHTML(post.content, 300)\n }\n };\n }\n\n // Publish to Bluesky\n const response = await fetch('https://bsky.social/xrpc/com.atproto.repo.createRecord', {\n method: 'POST',\n headers: {\n 'Authorization': `Bearer ${session.accessJwt}`,\n 'Content-Type': 'application/json'\n },\n body: JSON.stringify({\n repo: session.did,\n collection: 'app.bsky.feed.post',\n record: atPost\n })\n });\n\n if (response.ok) {\n const result = await response.json();\n console.log('Published to AT Protocol:', result.uri);\n } else {\n const error = await response.text();\n console.error('Failed to publish to AT Protocol:', response.status, error);\n }\n\n } catch (error) {\n console.error('Error publishing to AT Protocol:', error);\n throw error;\n }\n}\n\n/**\n * Create AT Protocol session\n */\nasync function createATProtoSession(handle: string, password: string): Promise {\n const response = await fetch('https://bsky.social/xrpc/com.atproto.server.createSession', {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json'\n },\n body: JSON.stringify({\n identifier: handle,\n password: password\n })\n });\n\n if (!response.ok) {\n const error = await response.text();\n throw new Error(`Failed to create AT Protocol session: ${error}`);\n }\n\n return await response.json();\n}\n\n/**\n * Get base URL for the application\n */\nfunction getBaseUrl(): string {\n // Prioritize BASE_URL environment variable for custom domains\n const baseUrl = Deno.env.get(\"BASE_URL\");\n if (baseUrl) {\n // Ensure the BASE_URL has a protocol\n if (baseUrl.startsWith(\"http://\") || baseUrl.startsWith(\"https://\")) {\n return baseUrl.replace(/\\/$/, \"\"); // Remove trailing slash if present\n } else {\n // Assume https if no protocol is specified\n return `https://${baseUrl}`;\n }\n }\n\n // Fall back to default Val Town URL format\n // This is a fallback when BASE_URL is not set\n return 'https://your-val-name.web.val.run';\n}",[],[280,446,490],"a448a802-69a3-11f0-aa22-0224a6c84d84","activitypub.ts","0198439f-c37b-732a-a383-8807d1a505e3",["D",1753481200444],"import { ActivityPubObject, BlogPost } from \"../../shared/types.ts\";\nimport { formatActivityPubDate, truncateHTML } from \"../../shared/utils.ts\";\nimport { getActiveFollowers } from \"../database/queries.ts\";\nimport { createActivityPubHeaders, getPublicKeyPem } from \"./http-signatures.ts\";\n\n/**\n * Publish a blog post to ActivityPub (Mastodon, etc.)\n */\nexport async function publishToActivityPub(post: BlogPost): Promise {\n const startTime = Date.now();\n console.log(\"🐘 === ACTIVITYPUB PUBLISH START ===\");\n\n try {\n const baseUrl = getBaseUrl();\n const actorId = `${baseUrl}/actor`;\n const postUrl = `${baseUrl}/post/${post.slug}`;\n\n console.log(\"📝 Creating ActivityPub activity:\", {\n postTitle: post.title,\n postSlug: post.slug,\n baseUrl: baseUrl,\n actorId: actorId,\n postUrl: postUrl,\n });\n\n // Create ActivityPub Note object\n const note: ActivityPubObject = {\n type: \"Note\",\n id: postUrl, // Use the actual post URL, not #activity\n attributedTo: actorId,\n content: `

${post.title}

${post.content}